spring-projects / spring-projects/spring-security

@EnableReactiveMethodSecurity does not support ResponseEntity<Publisher<T>> as return type

Open
#14,731 4 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: web status: blocked type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

According to the Webflux documentation it is allowed to use the return type ResponseEntity<Mono<T>>

Neither
AuthorizationManagerBeforeReactiveMethodInterceptor nor AuthorizationManagerAfterReactiveMethodInterceptor support this.

Using a method signature with the described return type causes an java.lang.IllegalStateException like

java.lang.IllegalStateException: The returnType class org.springframework.http.ResponseEntity on public org.springframework.http.ResponseEntity example.ExampleController.getSomething() must return an instance of org.reactivestreams.Publisher (for example, a Mono or Flux) in order to support Reactor Context
	at org.springframework.util.Assert.state(Assert.java:97)

Maybe a little bit of context:
We're using a code generator which produces such method signatures causing the exception whenever the return type is a list of something.
fun getSomething(): ResponseEntity<Flow<SomeDTO>>
We also found a workaround by adjusting the generator-based template but this is rather really just a workaround hence this ticket.

To Reproduce
Use simple project with spring-security 6.x and have @EnableReactiveMethodSecurity configured.
Add @PreAuthorize to a controller method with the return type ResponseEntity<Mono<T>> with T being some arbitrary DTO class.
Run the server, call the endpoint and you should see the mentioned exception.

Expected behavior
@EnableReactiveMethodSecurity should allow all valid return types defined for Webflux

Sample
Don't have one yet.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with AuthorizationManagerBeforeReactiveMethodInterceptor.java and AuthorizationManagerAfterReactiveMethodInterceptor.java at the referenced lines, then reproduce the failure using @EnableReactiveMethodSecurity, @PreAuthorize, and a ResponseEntity<Mono> controller method. Done means valid WebFlux response types no longer cause the reported IllegalStateException when the endpoint is called.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
backend-api-design, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.