spring-projects / spring-projects/spring-security
@PreAuthorize does not work with coroutines when referencing parameter names
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
Referencing parameter names in a @PreAuthorize("#x...") fails when using kotlin coroutines.
@PreAuthorize("#action.getUserId() == 1")
suspend fun save(action: Action)
Fails with:
Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1004E: Method call: Method getUserId() cannot be found on type java.lang.Object[]
Because in org.springframework.expression.spel.ast.MethodReference the value/targetObject is not of the expected Type Action but of type Object[] holding
[0] = "Action(userId=1)"
[1] = "Continuation at com.example.demoActionServiceTest$save...."
To Reproduce
See sample README.
Expected behavior
I expect to be able to reference parameters by their name.
Sample
https://github.com/RobertHeim/spring-security-bug-preauth-coroutines
Note that the sample uses SNAPSHOT, but the RC1 has the same bug.
Workaround
First, recognize that the problem only occurs when referencing the last parameter (because this is the one "transformed" to an object in order to hold the argument ([0]) as well as the coroutine continuation ([1])).
Adding [0] works:
@PreAuthorize("#action[0].getUserId() == 1")
Also removing the suspend and returning Mono works as well:
@PreAuthorize("#action.getUserId() == 1")
fun save(action: Action) : Mono<Unit>
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked sample README and reproduce the coroutine case using @PreAuthorize with a named parameter. Then inspect org.springframework.expression.spel.ast.MethodReference, focusing on how value/targetObject handles the last parameter as an Object[]; done means #action.getUserId() resolves the Action parameter without requiring [0].
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, kotlin, spring
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100