Expected Behavior
@PreAuthorize
perform the parameter binding in both class and interface level even with different formal paramter name.
Current Behavior
@PreAuthorize
perform the parameter binding in class level only. Parameter will be evaluated to null if it match the interface name but not the parameter name in implementor.
Context
Minimal Reproducible Code
I have an Authorizer bean, named as testBean
that contains a method isValidRequest(RequstDto request)
@Bean("testBean")
public class TestBean {
public boolean isValidRequest(RequestDto request) {
return request != null;
}
}
I have an interface that annotated with @PreAuthorize
public interface BusinessUseCase {
@PreAuthorize("@testBean.isValidRequest(#request)
void someBusinessFunction(RequestDto request);
}
I have implementation of this interface
public class TestService implements BusinessUseCase {
@Override
public void someBusinessFunction(RequestDto requestDto) {
// implementation omitted here
}
}
Given the method level security is enabled in the @Configuration
class, above code will always forbidden due to request
is evaluate to null
from isValidRequest
method.
The current work around is just simply make sure implementor of the interface have the same formal paramter name. However, due to the nature of the formal paramter, implementor might give the name in an arbitrary but meaningfull name of the parameter.
Therefore, just want to explore the option that whether Spring can perform the parameter binding that will take interface naming as part of the consideration so it won't evaluate to null every time with the above code.
Spring Version Spring Security: 3.5.3 Spring Boot: 3.5.3