使用 @PreAuthorize 注释 setter 会不会太残酷？
我有一个可能由不同演员编辑的特定实体。该场景的一个很好的例子是系统的用户，他可以编辑他们的个人数据（电话号码、电子邮件、密码），但不能修改例如他们的权限或用户名，这当然可以由超级用户来完成用户。
那么，如果我只是用 @PreAuthorize 注解 setter 方法，会不会太残酷太丑陋了？我能想到的唯一缺点是性能损失，但由于没有涉及我正在考虑的实体的批量操作，并且这些设置器永远不会经常被调用，所以现在似乎不再是一个问题。
I have a certain entity that can possibly be edited by different actors. A good example for the scenario would be an user of a system, who can edit their personal data (phone no, e-mail, password), but cannot modify e.g. their privileges or username, which could of course be done by a super-user.
So, would it be too brutal and ugly if I just annotated the setter methods with @PreAuthorize? The only disadvantage I could think of is the performance loss, but since there are no bulk operations involving the entity I am thinking of and those setters will never be called often it doesn't seem like a concern now.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我不建议这样做。首先，如果我看得正确的话，
@PreAuthorize要求一个类是一个 bean。一般来说，实体不是 spring bean（除非您使用 @Configurable 魔法）。所以这是行不通的。其次，
@PreAuthorize的更好位置是执行修改的业务方法。I wouldn't advise for that. First, if I see things properly,
@PreAuthorizerequires a class to be a bean. And generally, entities are not spring beans (unless you use the@Configurablemagic). So it just won't work.Second, the better place for
@PreAuthorizeis on the business methods that perform the modifications.