Spring Boot中JWT认证下@PreAuthorize资源权限控制的优化与扩展

一、现有用户资源权限验证的优化方向 #

你的当前方案可以正常运行，但从性能、代码一致性和健壮性角度，有以下优化点：

1. 减少重复数据库查询 #

当前isResourceOwner每次都通过用户名查询用户，完全可以在JWT认证阶段就把用户ID等核心信息存入自定义UserDetails，直接从Authentication的Principal中获取，避免重复查库：

// 自定义UserDetails实现
public class CustomUserDetails implements UserDetails {
    private Integer userId;
    private String username;
    // 其他必要字段、构造方法、getter/setter

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return Collections.singletonList(new SimpleGrantedAuthority("ROLE_USER"));
    }

    // 省略UserDetails接口其他默认方法实现
}

修改UserResourceValidator：

@Component
public class UserResourceValidator {
    
    public boolean isResourceOwner(Authentication authentication, Integer resourceId) {
        CustomUserDetails userDetails = (CustomUserDetails) authentication.getPrincipal();
        return userDetails.getUserId().equals(resourceId);
    }
}

2. 统一权限验证逻辑 #

把getUserByName的验证也纳入UserResourceValidator，保持代码风格一致：

// UserResourceValidator新增方法
public boolean isResourceOwnerByName(Authentication authentication, String name) {
    CustomUserDetails userDetails = (CustomUserDetails) authentication.getPrincipal();
    return userDetails.getUsername().equals(name);
}

更新UserService的注解：

@PreAuthorize("@userResourceValidator.isResourceOwnerByName(authentication, #name)")
public User getUserByName(String name) {
    return userRepository.findByName(name)
            .orElseThrow(() -> new AccessDeniedException("无访问权限"));
}

3. 替换空值返回为异常 #

当前返回null的处理方式不够规范，建议抛出Spring Security的AccessDeniedException，让框架统一处理403响应：

@PreAuthorize("@userResourceValidator.isResourceOwner(authentication, #id)")
public User getUserById(Integer id) {
    return userRepository.findById(id)
            .orElseThrow(() -> new AccessDeniedException("用户不存在或无访问权限"));
}

二、扩展到Book等其他资源的权限验证 #

要验证Book是否属于当前用户，核心是建立资源与用户的关联关系（比如Book实体包含userId字段），再通过以下方式实现验证：

1. 为每个资源单独实现验证类 #

定义通用接口规范，再针对Book实现专属验证逻辑：

// 通用资源所有者验证接口
public interface ResourceOwnerValidator<T> {
    boolean isOwner(Authentication authentication, T resourceId);
}

Book资源验证实现（假设BookRepository有existsByIdAndUserId方法）：

@Component
public class BookResourceValidator implements ResourceOwnerValidator<Integer> {
    
    @Autowired
    private BookRepository bookRepository;

    @Override
    public boolean isOwner(Authentication authentication, Integer bookId) {
        CustomUserDetails userDetails = (CustomUserDetails) authentication.getPrincipal();
        return bookRepository.existsByIdAndUserId(bookId, userDetails.getUserId());
    }
}

在BookService中使用：

@Service
public class BookService {
    
    @Autowired
    private BookRepository bookRepository;
    
    @Autowired
    private BookResourceValidator bookResourceValidator;

    @PreAuthorize("@bookResourceValidator.isOwner(authentication, #bookId)")
    public Book getBookById(Integer bookId) {
        return bookRepository.findById(bookId)
                .orElseThrow(() -> new AccessDeniedException("书籍不存在或无访问权限"));
    }
}

2. 备选：通用验证工具类 #

如果不想为每个资源单独写类，可以封装一个通用工具类，包含各资源的验证方法：

@Component
public class GenericResourceOwnerValidator {
    
    @Autowired
    private BookRepository bookRepository;

    public boolean isBookOwner(Authentication authentication, Integer bookId) {
        CustomUserDetails userDetails = (CustomUserDetails) authentication.getPrincipal();
        return bookRepository.existsByIdAndUserId(bookId, userDetails.getUserId());
    }

    // 可扩展其他资源的验证方法，比如isOrderOwner等
}

在Service中调用：

@PreAuthorize("@genericResourceOwnerValidator.isBookOwner(authentication, #bookId)")
public Book getBookById(Integer bookId) {
    // ...
}

内容的提问来源于stack exchange，提问作者O'Niel