How Mall’s Permission Management Works: Spring Security & OAuth2 Explained

mall项目中的权限管理功能是如何实现的？

Previously wrote several articles covering permission management overview, backend implementation, and frontend implementation; reading them gives a clear picture.

大家心心念念的权限管理功能，这次安排上了！

手把手教你搞定权限管理，结合Spring Security实现接口的动态权限控制！

手把手教你搞定权限管理，结合Vue实现菜单的动态权限控制！

ums_permission 表还在使用么？

The ums_permission table is no longer used, along with ums_admin_permission_relation and ums_role_permission_relation; the latest version has removed related code.

mall项目升级代码后 ums_resource 表找不到？

After upgrading, you must import the latest SQL scripts located in the project's document\sql folder; otherwise the new tables are missing.

只实现了管理后台的权限，移动端权限如何处理的？

The mobile side only implements login authentication and does not handle permissions yet.

在管理后台添加了一个菜单，为什么前端没有显示？

Only menus configured in the frontend routing will appear after being added in the admin backend.

前端路由中修改了菜单名称，为什么还是原来的名称？

Menu name, icon, and visibility are controlled by the admin backend; frontend changes are ineffective.

mall-swarm项目中的权限管理功能是如何实现的？

It uses a unified OAuth2 authentication and authorization approach, with an auth service for login and a gateway for verification. See the referenced article for details.

mall和mall-swarm项目中权限管理的实现有何不同？

mall uses Spring Security packaged as mall-security, which other modules depend on (e.g., mall-admin). mall-swarm uses OAuth2 + Gateway, providing centralized auth without a security toolkit, better for microservices.

mall-swarm项目对接前端项目时为什么会提示你已经被登出？

One cause is the frontend calling backend APIs directly without going through the gateway; update the base API path in mall-admin-web config (dev.env.js) to point to the gateway's mall-admin service.

'use strict'
const merge = require('webpack-merge')
const prodEnv = require('./prod.env')

module.exports = merge(prodEnv, {
  NODE_ENV: '"development"',
  BASE_API: '"http://localhost:8201/mall-admin"'
})

Another cause is missing whitelist entries for /mall-admin/admin/info in the gateway; remove it from the whitelist and ensure the interface is properly secured.

secure:
  ignore:
    urls: # configure whitelist paths
      - "/mall-admin/admin/info"

Since the interface is no longer whitelisted, logged‑in users must have the corresponding resource configured, otherwise login fails.

mall-swarm项目如何访问需要登录认证的接口？

Two user systems exist (admin and portal). Obtain a token from the auth center using the appropriate client_id and client_secret (admin‑app:123456 or portal‑app:123456), add the token to request headers, and call the protected APIs.

Token is also compatible with the original login APIs.

Backend login: http://localhost:8201/mall-admin/admin/login

Frontend login: http://localhost:8201/mall-portal/sso/login

只想学习权限管理功能，有没有什么简单的项目可以学习下？

You can study the mall-tiny project, a SpringBoot + MyBatis‑Plus scaffold with complete permission management and Vue integration. See the referenced article for details.