应用设置页权限控制问题：已隐藏菜单但普通用户可通过URL访问

Great catch on that critical gap! Hiding the menu entry is just UI-level obfuscation—it doesn't actually block users from accessing the page directly. To properly secure the /settings endpoint, you need to enforce server-side authorization rules with Spring Security. Here are the most straightforward solutions tailored to your setup:

1. Enforce URL-Level Security via Spring Security XML Configuration #

Since you're using the XML namespace for Spring Security, add an <intercept-url> rule to your security configuration file (usually spring-security.xml) to explicitly restrict access to /settings to users with the Administrator authority:

<http auto-config="true" use-expressions="true">
    <!-- Keep your existing HTTP security settings here -->
    
    <!-- Add this rule to block non-admins from /settings -->
    <intercept-url pattern="/settings" access="hasAuthority('Administrator')" />
</http>

This rule will intercept all incoming requests to /settings and check if the authenticated user has the required authority. If not, Spring Security will automatically redirect them to the login page (if unauthenticated) or return a 403 Forbidden response (if authenticated but lacking permissions).

2. Add Method-Level Security to Your Controller #

If you're using a Spring MVC Controller to handle the /settings request, you can apply fine-grained authorization directly to the handler method using annotations. First, enable pre/post method security in your XML config:

<global-method-security pre-post-annotations="enabled" />

Then, annotate your controller method with @PreAuthorize to enforce the authority check before the method executes:

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;

@Controller
public class SettingsController {

    @PreAuthorize("hasAuthority('Administrator')")
    @GetMapping("/settings")
    public String showSettingsPage() {
        return "settings"; // Your settings view name
    }
}

This approach is ideal if you need to secure individual methods rather than entire URL patterns, and it works alongside URL-level security for layered protection.

3. Optional: Customize the Access Denied Experience #

To improve user experience, you can configure a custom error page for users who try to access restricted resources:

<http auto-config="true" use-expressions="true">
    <!-- Existing config -->
    <access-denied-handler error-page="/403" />
</http>

Then create a simple controller to serve the 403 page:

@Controller
public class ErrorController {
    @GetMapping("/403")
    public String showAccessDeniedPage() {
        return "403"; // Your custom access denied view
    }
}

Key Takeaway #

Always remember: UI-level hiding is never sufficient for security. Server-side authorization checks are the only reliable way to prevent unauthorized access, as users can easily bypass UI restrictions by typing URLs directly, using bookmarks, or modifying HTTP requests.

内容的提问来源于stack exchange，提问作者user9729328