Skip to content

AuthorizeReturnObject should target the authorized object within Spring Data components #15994

Open
@noshua

Description

@noshua

Describe the bug
Using Authorizing Arbitrary Objects of Spring Security in combination with a Pageable Spring Data result fails.

To Reproduce

  1. Add "@PreAuthorize" to an Entity class.
  2. Add "@AuthorizeReturnObject" to a repository class method with return type Page.
  3. Call the repo method.

java.lang.ClassCastException: class org.springframework.security.authorization.method.AuthorizationAdvisorProxyFactory$ContainerTypeVisitor$$Lambda/0x0000791458a2cb00 cannot be cast to class org.springframework.data.domain.Page (org.springframework.security.authorization.method.AuthorizationAdvisorProxyFactory$ContainerTypeVisitor$$Lambda/0x0000791458a2cb00 and org.springframework.data.domain.Page are in unnamed module of loader 'app')

Expected behavior
A paged result of security proxied objects should be returned from the repository method.

Sample
https://github.com/noshua/authorize-spring-data

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions