grpc-ecosystem / grpc-ecosystem/grpc-spring

Client-Side Streaming with Spring Preauthorize?

Open
#650 2 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
Java
Stars
3.7k
Forks
858
PR merge metrics
No merged PRs in 30d

Description

**The context**

What do you wish to achieve?

**Leverage the `@Preauthorize` annotation with a custom method, with a Client-Side Streaming gRPC method.**

**The question**

What's the problem? What's not working? What's missing and why do you need it?

**Looking for examples, or suggestions as to what I'm doing wrong.**

**Stacktraces and logs**

Do you have any relevant stacktraces or logs of your attempts?

**The application's environment**

Which versions do you use?
* Spring (boot): **2.5.8 (boot)**
* grpc-java:
* grpc-spring-boot-starter: **2.13.1**
* java: version + architecture (64bit?): **17**
* Other relevant libraries...

**Additional information**

Hi, I have been using this framework quite successfully. I have one question.

I am attempting to apply a `@Preauthorize` annotation to a client-streaming method. So far, no luck.

To start, here's what my "simple RPC" endpoints look like:

```
@Override
@PreAuthorize("@fooAuthorizationService.isResourceAuthorizedReadWrite(authentication, #request.getTenantId())")
public void createFoo(CreateFooRequest request, StreamObserver responseObserver) {
...
}
```

Where I have a custom authorization service that validates a `tenant_id` field. This has worked well for my use case.

Now, I have a client-streaming endpoint:

```
@Override
public StreamObserver createFooStreamingRequest(StreamObserver responseObserver) {
return new StreamObserver<>() {
...

@Override
@PreAuthorize("@fooAuthorizationService.isResourceAuthorizedReadWrite(authentication, #createFooStreamingRequest.getTenantId())")
public void onNext(CreateFooStreamingRequest createFooStreamingRequest) {
try { ...
```

(followed by the onError() and onComplete() methods)

But, testing it out with no auth header or an intentionally broken auth header, the request succeeds -- seemingly disregarding the preauthorize annotation on `onNext()`.

Do you have any suggestions? I am googling how to use this annotation with streaming methods, but can't find any examples for a case like this.

Contributor guide

Open the contributing guide

Research direction

Start with the createFoo and createFooStreamingRequest entry points, then inspect how authorization is applied to the returned StreamObserver and its onNext method. Reproduce the request with no auth header and with the broken header described; done means the supported behavior and required integration point for client-streaming authorization are established.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring-boot
Domain
authorization, backend-api-design
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.