截至Spring Security doc: 34.1 @EnableWebMvcSecurity州,@ EnableWebMvcSecurity被@EnableWebSecurity取代.

但是当我尝试通过@AuthenticationPrincipal在控制器中获取UserDetails时,我得到了一个空对象：用户名为“”.我也尝试了@EnableWebMvcSecurity,但不幸的是UserDetails是null.

但我可以通过传统方式获取UserDetails,如下所示：

SecurityContextHolder.getContext().getAuthentication().getPrincipal();

我的问题是,当我使用@EnableWebSecurity时,获取自定义UserDetails(帐户)的正确方法是什么？

以下是相关的源代码：

控制器：

@RequestMapping(method = RequestMethod.POST)
@Secured("ROLE_USER")
public String postRoom(@Valid @modelattribute Room room,BindingResult result,Model model,@AuthenticationPrincipal Account principal) {
    if (result.hasErrors()) {
        return "room_form";
    }

    Account account = accountRepository.findByUsername(principal.getUsername());
    room.setAccountId(account.getId());
    room.setLastModified(new Date());
    roomRepository.save(room);
    return "room_list";
}

安全配置：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private DataSource dataSource;

    @Autowired
    private SecurityProperties security;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().permitAll()
            .and().formLogin().loginPage("/login").failureUrl("/login?error").permitAll()
            .and().logout().permitAll()
            .and().rememberMe()
            .and().csrf().disable();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth.jdbcAuthentication().dataSource(this.dataSource).passwordEncoder(new BCryptPasswordEncoder(8));
    }
}

而Account.java：

@Entity
@Table(name = "users")
public class Account implements Serializable {
    @Id
    @GeneratedValue
    private Long id;

    private String username;
    private String password;
    private boolean enabled;

    @Lob
    private byte[] avatar;

// getter / setter ...
}