grpc-ecosystem / grpc-ecosystem/grpc-spring
Client-Side Streaming with Spring Preauthorize?
- Dominant language
- Java
- Stars
- 3.7k
- Forks
- 858
- PR merge metrics
- No merged PRs in 30d
Description
**The context**
What do you wish to achieve?
**Leverage the `@Preauthorize` annotation with a custom method, with a Client-Side Streaming gRPC method.**
**The question**
What's the problem? What's not working? What's missing and why do you need it?
**Looking for examples, or suggestions as to what I'm doing wrong.**
**Stacktraces and logs**
Do you have any relevant stacktraces or logs of your attempts?
**The application's environment**
Which versions do you use?
* Spring (boot): **2.5.8 (boot)**
* grpc-java:
* grpc-spring-boot-starter: **2.13.1**
* java: version + architecture (64bit?): **17**
* Other relevant libraries...
**Additional information**
Hi, I have been using this framework quite successfully. I have one question.
I am attempting to apply a `@Preauthorize` annotation to a client-streaming method. So far, no luck.
To start, here's what my "simple RPC" endpoints look like:
```
@Override
@PreAuthorize("@fooAuthorizationService.isResourceAuthorizedReadWrite(authentication, #request.getTenantId())")
public void createFoo(CreateFooRequest request, StreamObserver responseObserver) {
...
}
```
Where I have a custom authorization service that validates a `tenant_id` field. This has worked well for my use case.
Now, I have a client-streaming endpoint:
```
@Override
public StreamObserver createFooStreamingRequest(StreamObserver responseObserver) {
return new StreamObserver<>() {
...
@Override
@PreAuthorize("@fooAuthorizationService.isResourceAuthorizedReadWrite(authentication, #createFooStreamingRequest.getTenantId())")
public void onNext(CreateFooStreamingRequest createFooStreamingRequest) {
try { ...
```
(followed by the onError() and onComplete() methods)
But, testing it out with no auth header or an intentionally broken auth header, the request succeeds -- seemingly disregarding the preauthorize annotation on `onNext()`.
Do you have any suggestions? I am googling how to use this annotation with streaming methods, but can't find any examples for a case like this.
Contributor guide
Research direction
Start with the createFoo and createFooStreamingRequest entry points, then inspect how authorization is applied to the returned StreamObserver and its onNext method. Reproduce the request with no auth header and with the broken header described; done means the supported behavior and required integration point for client-streaming authorization are established.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring-boot
- Domain
- authorization, backend-api-design
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100