<dependency>

       <groupId>org.springframework.security</groupId>

       <artifactId>spring-security-core</artifactId>

       <version>5.1.3.RELEASE</version>

     </dependency>

 package cn.coreqi.config;

 import org.springframework.context.annotation.Configuration;

 import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;

 import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;

 import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;

 import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration;

 @Configuration

 @EnableGlobalMethodSecurity(securedEnabled = true,jsr250Enabled = true,prePostEnabled = true) //启用基于注解的方法安全性

 public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {

     /**

      * 注册自定义的表达式处理器

      * @return

      */

 //    @Override

 //    protected MethodSecurityExpressionHandler createExpressionHandler() {

 //        DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();

 //        expressionHandler.setPermissionEvaluator(new UserPermissionEvaluator());

 //        return expressionHandler;

 //    }

 }

 package cn.coreqi.dao.redis;

 import cn.coreqi.entities.User;

 import org.springframework.security.access.annotation.Secured;

 import org.springframework.security.access.prepost.PostAuthorize;

 import org.springframework.security.access.prepost.PostFilter;

 import org.springframework.security.access.prepost.PreAuthorize;

 import org.springframework.security.access.prepost.PreFilter;

 import org.springframework.stereotype.Repository;

 import java.util.List;

 @Repository

 public class UserRedis {

     @Secured("ROLE_ADMIN")  //限制只有ROLE_ADMIN权限才可以调用此方法

     public List<User> getAll(){

         return null;

     }

     @PostAuthorize("returnObject.UserName == principal.username")    //方法返回时执行，根据表达式结果决定是否抛出安全性异常

     public User getById(int Id){

         return null;

     }

     @PreAuthorize("hasRole('ROLE_ADMIN') or hasRole('ROLE_SYSTEM') and #user.UserName.length() <= 16") //在方法调用前执行，如果表达式不为true则阻止方法执行

     public User modify(User user){

         return null;

     }

     public void delById(int Id){

     }

     @PostFilter("hasRole('ROLE_ADMIN') && filterObject.Age < 18") //使用表达式计算该方法返回中的每一个成员，将计算结果为false的成员移除掉。

     public List<User> findMeinv()

     {

         return null;

     }

     @PreFilter("hasRole('ROLE_ADMIN') && targetObject.Name == 'admin'") //在方法调用前对参数中的每一个元素进行过滤，只有满足表达式的元素才会保留到集合中

     public void batchAdd(List<User> users){

     }

 }

 package cn.coreqi.config;

 import org.springframework.security.access.PermissionEvaluator;

 import org.springframework.security.core.Authentication;

 import java.io.Serializable;

 /**

  * 自定义表达式处理器

  */

 public class UserPermissionEvaluator implements PermissionEvaluator {

     @Override

     public boolean hasPermission(Authentication authentication, Object o, Object o1) {

         return false;

     }

     @Override

     public boolean hasPermission(Authentication authentication, Serializable serializable, String s, Object o) {

         return false;

     }

 }