if (roles == null) { //为了安全期间,不允许这种无权限表的情况,所有一概返回500
if (log.isWarnEnabled())
log.warn("Role config not found?!");
return new HttpStatusView(500); //Deny all req
}
if (authService.isAuth(new AuthContext(me, auth, roles)))
return null;
return new HttpStatusView(403); //Not Ok,客户端就收到403响应了,标准的未授权
}