java @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) 与 Spring Security 中的 ManagementServerProperties.ACCESS_OVERRIDE_ORDER

@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) vs ManagementServerProperties.ACCESS_OVERRIDE_ORDER in Spring Security

提问by HopeKing

Question1:In Spring Security, what exactly is the function

问题1：Spring Security中的功能究竟是什么

@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)

@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)

Spring Documentation States the below, but I am not sure I understand it clearly

Spring 文档说明如下，但我不确定我是否清楚地理解它

To override the access rules without changing any other autoconfigured features add a @Bean of type WebSecurityConfigurerAdapter with @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER).

要在不更改任何其他自动配置功能的情况下覆盖访问规则，请添加类型为 WebSecurityConfigurerAdapter 的 @Bean @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)。

The ordering of various security features in Spring Security are as below as per my understanding (LowestValue i.e. Highest Precedence to Highest Value i.e. Lowest Precedence)

根据我的理解，Spring Security 中各种安全功能的排序如下（LowestValue ie Highest Precedence to Highest Value ie Lowest Precedence）

1. Ordered.HIGHEST_PRECEDENCE= -2^31-1
2. WebSecurityConfigurerAdapter = 100 (Based on @Order(100) mentioned in Docs)
   1. Access_Override_Order = Basic_Auth_Order -2for Security Properties
   2. Access_Override_Order = Basic_Auth_Order -1for ManagementServerPropertiesBasic_Auth_Order-2= 2^31-7
3. Basic_Auth_Order = Ordered.Lowest_Precendence -5 = 2^31-5
4. Ordered.LOWEST_PRECEDENCE = 2^31

1. Ordered.HIGHEST_PRECEDENCE= -2^31-1
2. WebSecurityConfigurerAdapter = 100（基于文档中提到的@Order(100)）
   1. Access_Override_Order = Basic_Auth_Order -2对于安全性属性
   2. Access_Override_Order = Basic_Auth_Order -1对于ManagementServerPropertiesBasic_Auth_Order-2= 2^31-7
3. Basic_Auth_Order = Ordered.Lowest_Precendence -5 = 2^31-5
4. Ordered.LOWEST_PRECEDENCE = 2^31

Question2Based on the ordering of various security features above, If I want to override default rules for both Management Endpoints and the Rest of the application, should I use

问题 2基于上述各种安全功能的排序，如果我想覆盖管理端点和应用程序其余部分的默认规则，我应该使用

• SecurityPropertiesACCESS_OVERRIDE_ORDER or
• ManagementServerProperties ACCESS_OVERRIDE_ORDER ?

• SecurityPropertiesACCESS_OVERRIDE_ORDER 或
• 管理服务器属性 ACCESS_OVERRIDE_ORDER ？

I am currently using SecurityProperties ACCESS_OVERRIDE_ORDERbut based on the suggestion hereto get ACTUATOR working I need to enable ManagementServerProperties ACCESS_OVERRIDE_ORDER. Which one should I override if I want both working ?

我目前正在使用，SecurityProperties ACCESS_OVERRIDE_ORDER但根据此处的建议 使 ACTUATOR 工作，我需要启用ManagementServerProperties ACCESS_OVERRIDE_ORDER. 如果我想让两者都工作，我应该覆盖哪一个？

Thanks.

谢谢。

采纳答案by Sanghyun Lee

Q1. Question1: In Spring Security, what exactly does the annotation @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)do?

一季度。问题一：在 Spring Security 中，注解究竟是@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)做什么的？

What it does is well explained in the documentation you quoted.

它的作用在您引用的文档中得到了很好的解释。

To override the access rules without changing any other autoconfigured features add a @Bean of type WebSecurityConfigurerAdapter with @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER).

要在不更改任何其他自动配置功能的情况下覆盖访问规则，请添加类型为 WebSecurityConfigurerAdapter 的 @Bean @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)。

But then WebSecurityConfigurerAdapter, which has @Order(100), takes higher priority.

但是WebSecurityConfigurerAdapter，具有 的@Order(100)具有更高的优先级。

No.

不。

You should be careful about this part autoconfigured features. Using @EnableAutoConfigurationwhich is a part of @SpringBootApplication, a lot of things are auto-configured and 100is not a auto-configured value but a hard-coded value on the WebSecurityConfigurerAdapterclass.

你应该小心这部分autoconfigured features。使用@EnableAutoConfigurationwhich 是 的一部分@SpringBootApplication，很多东西都是自动配置的，100不是自动配置的值，而是类上的硬编码值WebSecurityConfigurerAdapter。

You can find order values used for auto-configuring for Spring Security in SecurityPropertiesclass and you can find out that the value of ACCESS_OVERRIDE_ORDERis the lowest which means it takes the highest priority.

您可以在SecurityPropertiesclass 中找到用于 Spring Security 自动配置的 order 值，您可以发现 的值ACCESS_OVERRIDE_ORDER最低，这意味着它具有最高优先级。

Where are they auto-confitured?

它们在哪里自动配置？

You can find that @Order(SecurityProperties.BASIC_AUTH_ORDER)is used in SpringBootWebSecurityConfigurationclass.

你会发现它@Order(SecurityProperties.BASIC_AUTH_ORDER)是在SpringBootWebSecurityConfiguration课堂上使用的。

Then when is the annotation @Order(100)of WebSecurityConfigurerAdapterused?

然后，当被注释@Order(100)的WebSecurityConfigurerAdapter使用呢？

For example, if you disable the auto-configuring by adding @EnableWebSecurity, the value would be used. As the value 100takes too high priority, it'd be better to put @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)annotation in your custom class in the case.

例如，如果您通过添加禁用自动配置@EnableWebSecurity，则将使用该值。由于该值的100优先级太高，最好@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)在案例中将注释放在您的自定义类中。

Q2. Based on the ordering of various security features above, If I want to override default rules for both Management Endpoints and the Rest of the application, what should I use

Q2。基于上述各种安全功能的排序，如果我想覆盖管理端点和应用程序其余部分的默认规则，我应该使用什么

Use ManagementServerProperties ACCESS_OVERRIDE_ORDER.

使用ManagementServerProperties ACCESS_OVERRIDE_ORDER.

It takes higher priority so you must use it if you want to override default rules for all end points. You can see how the values are set if you open the ManagementServerPropertiesclass.

它具有更高的优先级，因此如果要覆盖所有端点的默认规则，则必须使用它。如果您打开ManagementServerProperties类，您可以看到这些值是如何设置的。

In SecurityProperties

在 SecurityProperties

int ACCESS_OVERRIDE_ORDER = SecurityProperties.BASIC_AUTH_ORDER - 2; // 39
int BASIC_AUTH_ORDER = Ordered.LOWEST_PRECEDENCE - 5; // 41

In ManagementServerProperties

在 ManagementServerProperties

int BASIC_AUTH_ORDER = SecurityProperties.BASIC_AUTH_ORDER - 5; // 36
int ACCESS_OVERRIDE_ORDER = ManagementServerProperties.BASIC_AUTH_ORDER - 1; // 35

In the comment, 39means 21474839, I've omitted the first 6 digits for readability.

在评论中，39意思是21474839，为了便于阅读，我省略了前 6 位数字。

回答by Ajay Khetan

SecurityPropertiesno longer defines the ACCESS_OVERRIDE_ORDERconstant for the @Order annotation. However, Spring Boot no longer defines any security details if the application does, so we do not need the @Order annotation on the security @Configuration class and can be removed.

SecurityProperties不再为 @Order 注释定义ACCESS_OVERRIDE_ORDER常量。但是，如果应用程序定义了任何安全细节，Spring Boot 就不再定义任何安全细节，因此我们不需要安全性 @Configuration 类上的 @Order 注解，并且可以将其移除。