spring-projects / spring-projects/spring-security
SEC-2024: Make getAuthoritySet() in SecurityExpressionRoot protected, not private
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Michał Politowski (Migrated from SEC-2024) said:
Currently when
- you want to create a custom SecurityExpressionRoot, based on one of the existing ones, to add more available operations,
- any of these operations are role-based,
it turns out that you have to reimplement (probably copy and paste, including used fields and the roleHierarchy setter) what getAuthoritySet() does.
(At least reimplement the part of it up until resolving the role hierarchy - there could be use cases for getting the authorities not flattened to strings.)
If getAuthoritySet() was protected and not private, it could be simply reused in these operations.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with SecurityExpressionRoot and its getAuthoritySet() method, then inspect how existing security expression roots use it and how role hierarchy resolution is handled. The change is done when custom SecurityExpressionRoot implementations can reuse the method through protected access without changing current authority behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100