动态重载用户权限：MethodSecurityExpressionOperations与GrantedAuthority选哪个？

Hey there! Let's dig into your question about dynamic permission reloading in Spring Security—specifically choosing between using GrantedAuthority with createAuthorityList and extending MethodSecurityExpressionOperations for your use case where permissions might get updated by other users while someone is actively using the system.

1. GrantedAuthority + createAuthorityList #

This is Spring Security's foundational permission model. Permissions are represented as GrantedAuthority instances, and AuthorityUtils.createAuthorityList() is just a convenient helper to spin up these instances quickly.

• Core logic: When a user logs in, their Authentication object stores these authorities in the SecurityContext (session-scoped by default). All subsequent URL/method authorization checks (like hasRole() or hasAuthority()) rely on this stored list.
• Dynamic update pain point: By default, the Authentication object is cached in the session. If another user updates this user's permissions, you'll need to either:
  • Manually refresh the Authentication object in the SecurityContext (e.g., via an API endpoint that re-fetches permissions and replaces the existing instance)
  • Force the user to log out and back in for changes to take effect

2. MethodSecurityExpressionOperations #

This is an interface for extending Spring Security's authorization expressions. You can create a custom expression root object to add your own authorization methods (like canEditResource()), which you can then use in @PreAuthorize annotations or URL security rules.

• Core logic: Instead of relying on a static list of authorities stored in the Authentication object, your custom expression methods can fetch the latest permissions in real-time during each authorization check. For example, you could pull fresh data from a database or cache every time the rule runs.
• Dynamic update advantage: No need to modify or refresh the Authentication object—changes take effect immediately the next time an authorization check is performed.

• Go with GrantedAuthority if: Your permission model is simple (just role/permission strings), and you're okay with adding a "refresh permissions" API or forcing session invalidation for updates to take effect. It's easy to implement and has minimal overhead for basic use cases.
• Go with MethodSecurityExpressionOperations if: You need complex, conditional authorization rules, or you require permission updates to take effect immediately without user intervention. This approach is built for dynamic, context-aware checks.

Quick Example of Custom Expression Root #

Here's a simplified snippet to show how you'd implement a custom expression that pulls fresh permissions:

// Custom expression root class
public class CustomSecurityExpressionRoot extends SecurityExpressionRoot implements MethodSecurityExpressionOperations {
    private final UserPermissionService permissionService;
    private Authentication authentication;

    public CustomSecurityExpressionRoot(Authentication auth, UserPermissionService permissionService) {
        super(auth);
        this.authentication = auth;
        this.permissionService = permissionService;
    }

    // Custom authorization method: Fetch latest permissions in real-time
    public boolean canAccessResource(String resourceId) {
        // Pull fresh permissions from DB/cache
        List<String> latestPermissions = permissionService.getLatestPermissions(authentication.getName());
        return latestPermissions.contains("RESOURCE_ACCESS_" + resourceId);
    }

    // Required implementations for MethodSecurityExpressionOperations
    @Override
    public void setFilterObject(Object filterObject) {}

    @Override
    public Object getFilterObject() { return null; }

    @Override
    public void setReturnObject(Object returnObject) {}

    @Override
    public Object getReturnObject() { return null; }

    @Override
    public Object getThis() { return this; }
}

// Configure the expression handler
@Configuration
@EnableMethodSecurity
public class SecurityConfig extends GlobalMethodSecurityConfiguration {
    private final UserPermissionService permissionService;

    public SecurityConfig(UserPermissionService permissionService) {
        this.permissionService = permissionService;
    }

    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        DefaultMethodSecurityExpressionHandler handler = new DefaultMethodSecurityExpressionHandler();
        handler.setExpressionRootFactory(context -> 
            new CustomSecurityExpressionRoot(context.getAuthentication(), permissionService)
        );
        return handler;
    }
}

Then use it in your controller:

@GetMapping("/resources/{id}")
@PreAuthorize("canAccessResource(#id)")
public ResponseEntity<Resource> getResource(@PathVariable String id) {
    // Your resource logic here
}

Pro tip: Whichever approach you pick, use a cache (like Redis) for permission data to balance real-time updates and performance.

内容的提问来源于stack exchange，提问作者Smart Developer