springboot-shiro-vue is a full-stack permission management system that demonstrates role-based access control across Spring Boot and Vue.js applications.
The system addresses the complexity of permission verification by implementing a core principle: backend interfaces validate permissions directly rather than roles. This approach treats roles as administrative tools for organizing and assigning permissions, while actual authorization checks operate at the permission level. The architecture separates concerns between frontend and backend. The backend enforces security through permission validation on API endpoints using custom annotations and aspect-oriented programming. The frontend receives permission and menu information from the backend after login, using this data to dynamically generate routes and conditionally display UI elements like buttons and menus. This dual-layer approach ensures that even if frontend controls are bypassed, the backend remains secure.
The project suits teams building applications that require granular, button-level and interface-level permission control with role-based administration. It works well for systems where users can hold multiple roles simultaneously and where permission hierarchies need to be managed without hardcoding role logic into endpoint validation. The implementation provides a concrete example of RBAC principles applied to a Spring Boot and Vue stack, making it useful as a reference architecture or starting point for similar permission systems.
The codebase shows active refinement toward simplification. A significant architectural change removed the Shiro dependency in favor of custom annotations combined with aspect-oriented programming, reducing configuration complexity while improving extensibility. The project introduced support for multiple roles per user and replaced session-based authentication with token-based login to eliminate cross-origin issues. The frontend implementation builds on established Vue templates and component libraries, incorporating dynamic routing patterns for permission-driven UI generation.
