spring-projects / spring-projects/spring-security

Spring Formatters have been not registered when some class extends WebSecurityConfigurerAdapter

Open
#4,202 14 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

The desired steps to a valid Formatters registration are:

  1. First of all, the method addWebMvcConfigurers located in WebMvcConfigurationComposite should registrate all the web configurers. That includes the formatters.
  2. After that, when some component needs to @Autowired a ConversionService instance, the method mvcConversionService located in WebMvcConfigurationSupport obtains a ConversionService instance and register all the existing formatters on it before return the instance.

However, if a @Configuration class extends the WebSecurityConfigurerAdapter abstract class, some component is trying to @Autowired a ConversionService instance before the formatters have been registered in the Spring context, so the addFormatters method doesn't include any formatters on it.

I've just created the following proof of concept that uses Spring Boot to reproduce this issue:

https://github.com/jcagarcia/proofs/tree/master/spring-security-and-formatters

If you execute this proof of concept using the mvn compile spring-boot:run command, you could check that the Create Pets view shows an enum value without apply the conversion to String.

enter image description here

Seems like the component that requires the ConversionService instance is the ContentNegotiation that is beeing @Autowired in the WebSecurityConfigurerAdapter.

A simple work-around is to @Override the setContentNegotiationStrategy method in our SecurityConfiguration class without include the @Autowired annotation. (The proof of concept includes this work-around commented)

After that, execute this proof of concept again using the mvn compile spring-boot:run command and you could check that the Create Pets view shows an enum value with a valid format applied.

enter image description here

I think this is not the best solution because the ContentNegotiationStrategy is not beeing @Autowired anymore.

I've just created a question in StackOverflow to obtain some answer:

http://stackoverflow.com/questions/42086046/spring-formatters-have-been-not-registered-when-some-class-extends-websecurityco

Best Regards,

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Run the linked Spring Boot proof of concept with mvn compile spring-boot:run to reproduce the formatter behavior. Then inspect WebMvcConfigurerComposite.addWebMvcConfigurers, WebMvcConfigurationSupport.mvcConversionService, and WebSecurityConfigurerAdapter as referenced. Done means formatters are registered when a configuration extends WebSecurityConfigurerAdapter, without relying on the workaround in SecurityConfiguration.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.