spring-projects / spring-projects/spring-data-rest
PreAuthorize annotation not applied for PATCH request [DATAREST-877]
@odrotbohm is already working on this.
Since Dec 31, 2020.
- Dominant language
- Java
- Stars
- 958
- Forks
- 568
- PR merge metrics
- No merged PRs in 30d
Description
Raghavendra Chary B opened DATAREST-877 and commented
We are using spring data rest, with spring security applied on repository, like below:
@PreAuthorize("hasRole('ROLE_ADMIN')")
Order save(@P("order") Order order);
In case of POST and PUT, PreAuthorize is working as expected i.e it doesnt change values in database and gives 403 for non-admin user.
In case of PATCH request, it changes value in database and gives 403. Would like to know why PreAuthorize not applied in case of PATCH.
Affects: 2.2.4 (Evans SR4)
Reference URL: http://stackoverflow.com/questions/39053117/spring-data-rest-preauthorize-annotation-not-applied-for-patch-request
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.