spring-projects / spring-projects/spring-security
@EnableReactiveMethodSecurity does not support ResponseEntity<Publisher<T>> as return type
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
According to the Webflux documentation it is allowed to use the return type ResponseEntity<Mono<T>>
Neither
AuthorizationManagerBeforeReactiveMethodInterceptor nor AuthorizationManagerAfterReactiveMethodInterceptor support this.
Using a method signature with the described return type causes an java.lang.IllegalStateException like
java.lang.IllegalStateException: The returnType class org.springframework.http.ResponseEntity on public org.springframework.http.ResponseEntity example.ExampleController.getSomething() must return an instance of org.reactivestreams.Publisher (for example, a Mono or Flux) in order to support Reactor Context
at org.springframework.util.Assert.state(Assert.java:97)
Maybe a little bit of context:
We're using a code generator which produces such method signatures causing the exception whenever the return type is a list of something.
fun getSomething(): ResponseEntity<Flow<SomeDTO>>
We also found a workaround by adjusting the generator-based template but this is rather really just a workaround hence this ticket.
To Reproduce
Use simple project with spring-security 6.x and have @EnableReactiveMethodSecurity configured.
Add @PreAuthorize to a controller method with the return type ResponseEntity<Mono<T>> with T being some arbitrary DTO class.
Run the server, call the endpoint and you should see the mentioned exception.
Expected behavior
@EnableReactiveMethodSecurity should allow all valid return types defined for Webflux
Sample
Don't have one yet.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with AuthorizationManagerBeforeReactiveMethodInterceptor.java and AuthorizationManagerAfterReactiveMethodInterceptor.java at the referenced lines, then reproduce the failure using @EnableReactiveMethodSecurity, @PreAuthorize, and a ResponseEntity<Mono> controller method. Done means valid WebFlux response types no longer cause the reported IllegalStateException when the endpoint is called.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- backend-api-design, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100