基于Bearer Token主体的端点所有者授权替代方案咨询

一、自定义注解 + 切面（最适合多场景复用） #

这是最直接的复用方案，把授权逻辑抽成切面，用注解标记需要校验的方法，不用在每个控制器里重复写判断代码：

1. 定义自定义注解 #

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface ResourceOwnerOnly {
    // 可指定方法中哪个参数是资源ID，默认取"id"
    String resourceIdParam() default "id";
}

2. 编写切面处理校验逻辑 #

阻塞式场景（Spring MVC）

直接写普通切面即可：

@Aspect
@Component
public class ResourceOwnerAspect {
    private final UserService userService;

    public ResourceOwnerAspect(UserService userService) {
        this.userService = userService;
    }

    @Around("@annotation(resourceOwnerOnly)")
    public Object checkOwner(ProceedingJoinPoint joinPoint, ResourceOwnerOnly resourceOwnerOnly) throws Throwable {
        // 从方法参数中提取资源ID
        String resourceIdParam = resourceOwnerOnly.resourceIdParam();
        MethodSignature signature = (MethodSignature) joinPoint.getSignature();
        Parameter[] parameters = signature.getMethod().getParameters();
        Object resourceId = null;
        for (int i = 0; i < parameters.length; i++) {
            if (parameters[i].getName().equals(resourceIdParam)) {
                resourceId = joinPoint.getArgs()[i];
                break;
            }
        }

        // 获取当前登录用户的主体ID
        String currentPrincipal = SecurityContextHolder.getContext().getAuthentication().getName();

        // 校验所有者权限，不通过则抛出异常
        if (!userService.isLoggedInUserTheOwner(String.valueOf(resourceId), currentPrincipal)) {
            throw new AccessDeniedException("无资源访问权限");
        }

        return joinPoint.proceed();
    }
}

响应式场景（Spring WebFlux）

要避免IO线程阻塞，把阻塞操作放到专用线程池执行：

@Aspect
@Component
public class ResourceOwnerReactiveAspect {
    private final UserService userService;
    private final TaskExecutor taskExecutor;

    public ResourceOwnerReactiveAspect(UserService userService, @Qualifier("authTaskExecutor") TaskExecutor taskExecutor) {
        this.userService = userService;
        this.taskExecutor = taskExecutor;
    }

    @Around("@annotation(resourceOwnerOnly)")
    public Object checkOwner(ProceedingJoinPoint joinPoint, ResourceOwnerOnly resourceOwnerOnly) throws Throwable {
        // 提取资源ID（逻辑同阻塞式）
        String resourceId = // 从方法参数中获取资源ID的逻辑
        
        // 获取当前登录用户主体ID
        String currentPrincipal = ReactiveSecurityContextHolder.getContext()
                .map(SecurityContext::getAuthentication)
                .map(Authentication::getName)
                .block();

        // 将阻塞校验操作提交到专用线程池
        boolean isOwner = Mono.fromCallable(() -> 
                userService.isLoggedInUserTheOwner(resourceId, currentPrincipal))
                .subscribeOn(Schedulers.fromExecutor(taskExecutor))
                .block();

        if (!isOwner) {
            throw new AccessDeniedException("无资源访问权限");
        }

        return joinPoint.proceed();
    }
}

3. 在控制器方法上使用注解 #

@GetMapping("/users/{id}/activities")
@ResourceOwnerOnly(resourceIdParam = "id")
public ResponseEntity<List<Activity>> getUserActivities(@PathVariable String id) {
    // 业务逻辑代码
}

二、Spring Security方法级安全（@PreAuthorize） #

如果已经集成Spring Security，直接用SpEL表达式调用服务方法，无需额外写切面：

1. 开启方法级安全 #

@Configuration
@EnableMethodSecurity
public class SecurityConfig {
    // 其他安全配置
}

2. 在控制器方法上添加注解 #

@GetMapping("/users/{id}/activities")
@PreAuthorize("@userService.isLoggedInUserTheOwner(#id, authentication.name)")
public ResponseEntity<List<Activity>> getUserActivities(@PathVariable String id) {
    // 业务逻辑代码
}

响应式环境注意：如果userService的方法是阻塞的，要包装成响应式调用，或者直接把校验方法改成返回Mono<Boolean>：

@PreAuthorize("@userService.isLoggedInUserTheOwnerReactive(#id, authentication.name)")

三、修复自定义策略的线程阻塞问题 #

你之前遇到的You have attempted to perform a blocking operation on a IO thread错误，是因为在响应式框架的IO线程中调用了阻塞方法。解决核心是把阻塞操作转移到专用线程池：

以Spring WebFlux的AuthorizationManager为例：

@Component
public class ResourceOwnerAuthorizationManager implements AuthorizationManager<HttpServletRequest> {
    private final UserService userService;
    private final TaskExecutor taskExecutor;

    public ResourceOwnerAuthorizationManager(UserService userService, TaskExecutor taskExecutor) {
        this.userService = userService;
        this.taskExecutor = taskExecutor;
    }

    @Override
    public Mono<AuthorizationDecision> check(Mono<Authentication> authentication, HttpServletRequest request) {
        String resourceId = request.getPathVariable("id");
        
        return authentication
                .map(Authentication::getName)
                .flatMap(principal -> 
                        Mono.fromCallable(() -> userService.isLoggedInUserTheOwner(resourceId, principal))
                                .subscribeOn(Schedulers.fromExecutor(taskExecutor))
                )
                .map(isOwner -> new AuthorizationDecision(isOwner))
                .defaultIfEmpty(new AuthorizationDecision(false));
    }
}

然后在安全配置中注册：

@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http, ResourceOwnerAuthorizationManager ownerAuthManager) {
    return http
            .authorizeExchange(exchanges -> exchanges
                    .pathMatchers("/users/{id}/activities").access(ownerAuthManager)
                    .anyExchange().authenticated()
            )
            .build();
}

总结 #

• 追求代码复用和简洁：优先用自定义注解+切面或**@PreAuthorize方法级安全**
• 响应式环境下：必须确保阻塞操作脱离IO线程，用线程池或响应式方法处理
• 全局路径级授权：用自定义AuthorizationManager（WebFlux）或AccessDecisionVoter（Spring MVC）

内容的提问来源于stack exchange，提问作者kamate