SEC-151: Add comment about BeanNameAutoProxyCreator.
This commit is contained in:
parent
433e5fb858
commit
9766ee1cbe
|
@ -743,6 +743,26 @@ public interface BankManager {
|
|||
Jakarta Commons Attributes method of configuration, you should set
|
||||
<literal>validateConfigAttributes</literal> to
|
||||
<literal>false</literal>.</para>
|
||||
|
||||
<para>Please note that when using
|
||||
<literal>BeanNameAutoProxyCreator</literal> to create the required
|
||||
proxy for security, the configuration must contain the property
|
||||
<literal>proxyTargetClass</literal> set to <literal>true</literal>.
|
||||
Otherwise, the method passed to
|
||||
<literal>MethodSecurityInterceptor.invoke</literal> is the proxy's
|
||||
caller, not the proxy's target. Note that this introduces a
|
||||
requirement on CGLIB. See an example of using
|
||||
<literal>BeanNameAutoProxyCreator</literal> below:</para>
|
||||
|
||||
<para><programlisting><bean id="autoProxyCreator" class="org.springframework.aop.framework.autoproxy.BeanNameAutoProxyCreator">
|
||||
<property name="interceptorNames">
|
||||
<list><value>methodSecurityInterceptor</value></list>
|
||||
</property>
|
||||
<property name="beanNames">
|
||||
<list><value>targetObjectName</value></list>
|
||||
</property>
|
||||
<property name="proxyTargetClass" value="true"/>
|
||||
</bean> </programlisting></para>
|
||||
</sect2>
|
||||
|
||||
<sect2 id="security-interception-aspectj">
|
||||
|
|
Loading…
Reference in New Issue