您需要确保在DefaultMethodSecurityExpresssionHandler上设置ApplicationContext。例如:
@Autowired
private ApplicationContext context;
@Override
protected MethodSecurityExpressionHandler expressionHandler() {
DefaultMethodSecurityExpressionHandler expressionHandler =
new DefaultMethodSecurityExpressionHandler();
expressionHandler.setPermissionEvaluator(appPermissionEvaluator());
expressionHandler.setApplicationContext(context);
return expressionHandler;
}
另外,更简洁地说,如果您将单个PermissionEvaluator定义为Bean,Spring Security将自动选择它(无需覆盖expressionHandler())。例如:
@Bean
public PermissionEvaluator appPermissionEvaluator() {
...
}