spring-projects / spring-projects/spring-security

AnonymousConfigurer.authorities only accepts GrantedAuthorities but no subtypes of GrantedAuthorities

Open
#14,435 3 comments 0 reactions 1 assignee View on GitHub

@sjohnr is already working on this.

Since Jan 11, 2024.

in: config type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Expected Behavior

I expected the builder method of AnonymousConfigurer.authorities(authorities) to take a List<? extends GrantedAuthority> authorities as parameter

Current Behavior

AnonymousConfigurer.authorities(authorities) takes a List<GrantedAuthority> as parameter

Context
As of now, I cannot think of a reason to not allow subtypes of GrantedAuthorities.
E.g., when creating a new User, one can specify a Collection<? extends GrantedAuthority>

How has this issue affected you?
We converted a list of Strings to GrantedAuthorities but since this is an interface type, we created objects of type SimpleGrantedAuthority. Using Stream.toList() to convert this stream of objects into an unmodifiable list results in a List<SimpleGrantedAuthority>.

What are you trying to accomplish?
Directly using a List<SimpleGrantedAuthority> to avoid any casting.

What other alternatives have you considered?
Cast the list elements, so the list elements have the correct type.

Are you aware of any workarounds?
See above

I'm happy to contribute a PR if this is accepted

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.