spring-projects / spring-projects/spring-security

@PreAuthorize does not work with coroutines when referencing parameter names

Open
#9,670 4 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: core status: blocked type: bug
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
Referencing parameter names in a @PreAuthorize("#x...") fails when using kotlin coroutines.

@PreAuthorize("#action.getUserId() == 1")
suspend fun save(action: Action)

Fails with:

Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1004E: Method call: Method getUserId() cannot be found on type java.lang.Object[]

Because in org.springframework.expression.spel.ast.MethodReference the value/targetObject is not of the expected Type Action but of type Object[] holding

[0] = "Action(userId=1)"
[1] = "Continuation at com.example.demoActionServiceTest$save...."

To Reproduce
See sample README.

Expected behavior
I expect to be able to reference parameters by their name.

Sample

https://github.com/RobertHeim/spring-security-bug-preauth-coroutines

Note that the sample uses SNAPSHOT, but the RC1 has the same bug.

Workaround
First, recognize that the problem only occurs when referencing the last parameter (because this is the one "transformed" to an object in order to hold the argument ([0]) as well as the coroutine continuation ([1])).

Adding [0] works:

@PreAuthorize("#action[0].getUserId() == 1")

Also removing the suspend and returning Mono works as well:

@PreAuthorize("#action.getUserId() == 1")
fun save(action: Action) : Mono<Unit>

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked sample README and reproduce the coroutine case using @PreAuthorize with a named parameter. Then inspect org.springframework.expression.spel.ast.MethodReference, focusing on how value/targetObject handles the last parameter as an Object[]; done means #action.getUserId() resolves the Action parameter without requiring [0].

Written by the indexing model from the issue text.

Assessment

Tech stack
java, kotlin, spring
Domain
authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.