Spring-Security笔记6 自定义AccessDeniedHandler

最新推荐文章于 2025-08-11 16:37:32 发布

tjyyyangyi

最新推荐文章于 2025-08-11 16:37:32 发布

阅读量1.9w

点赞数 3

CC 4.0 BY-SA版权

分类专栏： Spring-Security

本文链接：https://blog.csdn.net/tjyyyangyi/article/details/79413548

Spring-Security 专栏收录该内容

13 篇文章

订阅专栏

本文介绍了如何在Spring Security中自定义AccessDeniedHandler以适配Ajax请求。由于Spring默认的AccessDeniedHandler仅处理页面请求，通过扩展AccessDeniedHandlerImpl，我们可以为Ajax请求提供定制的错误处理。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

在Spring默认的AccessDeniedHandler中只有对页面请求的处理，而没有对Ajax的处理。而在项目开发是Ajax又是我们要常用的技术，所以我们可以通过自定义AccessDeniedHandler来处理Ajax请求。我们在Spring默认的AccessDeniedHandlerImpl上稍作修改就可以了。

package com.fhzz.core.sercurity.handler;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.stereotype.Service;

import com.fhzz.core.utils.HTTPUtils;

/**
 * @author YangYi
 * @description 自定义权限不足处理程序
 */

@Service
public class CustomAccessDeniedHandler implements AccessDeniedHandler {

	@Override
	public void handle(HttpServletRequest request,
			HttpServletResponse response,
			AccessDeniedException accessDeniedException) throws IOException,
			ServletException {
		if (HTTPUtils.isAjaxRequest(request)) {// AJAX请求,使用response发送403
			response.sendError(403);
		} else if (!response.isCommitted()) {// 非AJAX请求，跳转系统默认的403错误界面，在web.xml中配置
			response.sendError(HttpServletResponse.SC_FORBIDDEN,
					accessDeniedException.getMessage());
		}
	}

}

package com.fhzz.core.utils;

import javax.servlet.http.HttpServletRequest;

/**
 * @author YangYi
 * 
 */
public class HTTPUtils {
	/**
	 * 从request获取登录的IP
	 */
	public static String getIpAddress(HttpServletRequest request) {
		String ip = request.getHeader("x-forwarded-for");
		if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
			ip = request.getHeader("Proxy-Client-IP");
		}
		if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
			ip = request.getHeader("WL-Proxy-Client-IP");
		}
		if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
			ip = request.getHeader("HTTP_CLIENT_IP");
		}
		if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
			ip = request.getHeader("HTTP_X_FORWARDED_FOR");
		}
		if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
			ip = request.getRemoteAddr();
		}
		return ip;
	}

	/**
	 *  判断是否为ajax请求
	 */
	public static boolean isAjaxRequest(HttpServletRequest request) {
		if (request.getHeader("accept").indexOf("application/json") > -1
				|| (request.getHeader("X-Requested-With") != null && request.getHeader("X-Requested-With").equals(
						"XMLHttpRequest"))) {
			return true;
		}
		return false;
	}

}

然后在spring-security.xml中配置上：

<!-- 自定义的access-denied-handler -->
<access-denied-handler ref="defaultAccessDeniedHandler" />