How to deal with defaultRolePrefix=“ROLE_” in Spring Security update from 3.2.7 to 4.0.2.RELEASE

问题:

My Spring Boot application works on Spring Security 3.2.7.RELEASE. Now, I'd like to update it to 4.0.2.RELEASE.

After hours of debug I have found that Spring Security 4.0.2.RELEASE uses defaultRolePrefix="ROLE_"

in

org.springframework.security.access.expression.SecurityExpressionRoot.hasAnyAuthorityName(String prefix, String... roles) method

In my application I use roles without this prefix and accordingly I get AccessDeniedException.

How to configure Spring Boot in order to use SecurityExpressionRoot.defaultRolePrefix="" ?

回答1:

I found the solution how to fix it. I need to change hasRole to hasAuthority, for example:

@PreAuthorize("hasAuthority('PERMISSION_CREATE_NODE')") 

回答2:

In the other hand you can remove role prefix ass described here. In this cas you are free to use other annotations.

文章来源: How to deal with defaultRolePrefix=“ROLE_” in Spring Security update from 3.2.7 to 4.0.2.RELEASE