spring-projects / spring-projects/spring-security
SEC-2652: DefaultWebSecurityExpressionHandler is hard to extend
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Marten Deinum (Migrated from SEC-2652) said:
It would be nice if there would be a protected accessor method for the trustResolver in DefaultWebSecurityExpressionHandler. This would make it easier for subclasses to get access to the trustResolver when a custom/extended WebSecurityExpressionRoot is added.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at DefaultWebSecurityExpressionHandler, the entry point named in the issue, and inspect how its trustResolver is stored and used. Add the requested protected accessor so subclasses can reach the trustResolver when extending WebSecurityExpressionRoot; done means custom subclasses can access it without changing visibility elsewhere.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 50/100