快捷導(dǎo)航

Shiro @RequiresPermissions不生效原因及解決方案

更新時間：2026年05月28日 09:09:44 作者：Mr.Java.

Shiro@rio@RequiresPermissions不生效的原因分析,包括AOP配置和權(quán)限寫寫法錯誤,幫助開發(fā)者正確配置AOP依賴和理解權(quán)限寫法,以確保權(quán)限檢查功能正常運行

Shiro @RequiresPermissions不生效原因

原因一、AOP不生效導(dǎo)致

檢查maven，添加AOP依賴：

        <!-- AOP依賴,必須,否則shiro權(quán)限攔截驗證不生效 -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-aop</artifactId>
        </dependency>

檢查代碼，開啟了注解支持

    /**
     * Shiro生命周期處理器
     */
    @Bean(name = "lifecycleBeanPostProcessor")
    public static LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

    /**
     * 開啟Shiro的注解(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP掃描使用Shiro注解的類,并在必要時進(jìn)行安全邏輯驗證
     */
    @Bean
    @DependsOn("lifecycleBeanPostProcessor")
    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        advisorAutoProxyCreator.setProxyTargetClass(true);
        return advisorAutoProxyCreator;
    }

    /**
     * 開啟Shiro-aop注解支持
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
        return authorizationAttributeSourceAdvisor;
    }

原因二、@RequiresPermissions 寫法含有(冒號: 逗號, 星號*)

源碼校驗權(quán)限的時候，會調(diào)用

org.apache.shiro.realm.AuthorizingRealm#isPermitted(org.apache.shiro.authz.Permission, org.apache.shiro.authz.AuthorizationInfo)

源碼：

org.apache.shiro.authz.permission.WildcardPermission#implies

 public boolean implies(Permission p) {
        // By default only supports comparisons with other WildcardPermissions
        if (!(p instanceof WildcardPermission)) {
            return false;
        }

        WildcardPermission wp = (WildcardPermission) p;

        List<Set<String>> otherParts = wp.getParts();

        int i = 0;
        for (Set<String> otherPart : otherParts) {
            // If this permission has less parts than the other permission, everything after the number of parts contained
            // in this permission is automatically implied, so return true
            if (getParts().size() - 1 < i) {
                return true;
            } else {
                Set<String> part = getParts().get(i);
                if (!part.contains(WILDCARD_TOKEN) && !part.containsAll(otherPart)) {
                    return false;
                }
                i++;
            }
        }

        // If this permission has more parts than the other parts, only imply it if all of the other parts are wildcards
        for (; i < getParts().size(); i++) {
            Set<String> part = getParts().get(i);
            if (!part.contains(WILDCARD_TOKEN)) {
                return false;
            }
        }

        return true;
    }

含有(冒號: 逗號, 星號*)會前綴匹配放權(quán)，

例如：

A用戶有 sys:role 的權(quán)限，那么 @RequiresPermissions("sys:role:add")對它來說，也可以。

就是 sys:role 擁有了 sys:role:* 的權(quán)限，不管 sys:role:add 還是 sys:role:delete 都無法攔截它。