spring-projects / spring-projects/spring-security
SEC-2997: @AuthenticationPrincipal Optional<UserDetails> principal
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Christopher Smith (Migrated from SEC-2997) said:
Most parameter bindings now support Optional, but @AuthenticationPrincipal doesn't. This causes some difficulties when trying to MockMvc-test controllers that use optional authentication, since my UserDetails doesn't have a default constructor and thus spinning up the entire Spring Security context is necessary just to get null passed to the method. Supporting Optional, which would let the MVC mapper supply the "null" on its own, would eliminate the need.
Currently, trying to use Optional with @AuthenticationPrincipal results in a null Optional.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the @AuthenticationPrincipal argument-resolution entry point and compare its behavior with MVC bindings that already support Optional. Reproduce the case with a MockMvc-tested controller using Optional; done means an absent principal is supplied as an empty Optional rather than a null Optional.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, backend
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100