spring-projects / spring-projects/spring-security
@PreAuthorize perform the paramter binding on implementor only
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
@PreAuthorize perform the parameter binding in both class and interface level even with different formal paramter name.
Current Behavior
@PreAuthorize perform the parameter binding in class level only. Parameter will be evaluated to null if it match the interface name but not the parameter name in implementor.
Context
Minimal Reproducible Code
I have an Authorizer bean, named as testBean that contains a method isValidRequest(RequstDto request)
@Bean("testBean")
public class TestBean {
public boolean isValidRequest(RequestDto request) {
return request != null;
}
}
I have an interface that annotated with @PreAuthorize
public interface BusinessUseCase {
@PreAuthorize("@testBean.isValidRequest(#request)
void someBusinessFunction(RequestDto request);
}
I have implementation of this interface
public class TestService implements BusinessUseCase {
@Override
public void someBusinessFunction(RequestDto requestDto) {
// implementation omitted here
}
}
Given the method level security is enabled in the @Configuration class, above code will always forbidden due to request is evaluate to null from isValidRequest method.
The current work around is just simply make sure implementor of the interface have the same formal paramter name. However, due to the nature of the formal paramter, implementor might give the name in an arbitrary but meaningfull name of the parameter.
Therefore, just want to explore the option that whether Spring can perform the parameter binding that will take interface naming as part of the consideration so it won't evaluate to null every time with the above code.
Spring Version
Spring Security: 3.5.3
Spring Boot: 3.5.3
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with Spring Security's @PreAuthorize method-level security parameter binding using the minimal reproducer in the issue. Compare binding for the interface declaration with the implementing method's parameter name. Done means the interface parameter name no longer evaluates to null when the implementor uses a different formal name.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authorization, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100