Skip to content

Add AfterMethodAuthorizationManager #9591

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
jzheaux opened this issue Apr 10, 2021 · 0 comments
Closed

Add AfterMethodAuthorizationManager #9591

jzheaux opened this issue Apr 10, 2021 · 0 comments
Assignees
@jzheaux
Labels
in: core An issue in spring-security-core type: enhancement A general enhancement
Milestone
5.5.0-RC1

Comments

@jzheaux
Copy link
Contributor

jzheaux commented Apr 10, 2021

Related to #9289, after a method is invoked, authorization needs to know the object returned from the method invocation.

Because method invocations happen frequently, it's better to not create a new context object to hold both the MethodInvocation and the returned value. A new interface will allow for the return value to be passed in as a separate parameter instead.

Note that this is similar to AfterInvocationManager, though following AuthorizationManager's design, which allows for returning a decision instead of throwing an exception.
@jzheaux jzheaux added in: core An issue in spring-security-core type: enhancement A general enhancement labels Apr 10, 2021
@jzheaux jzheaux added this to the 5.5.0-RC1 milestone Apr 10, 2021
@jzheaux jzheaux self-assigned this Apr 10, 2021
jzheaux added a commit to jzheaux/spring-security that referenced this issue Apr 13, 2021
@jzheaux
Add AfterMethodAuthorizationManager
92b6803 
- Removes the need to keep MethodAuthorizationContext#returnObject
in sync with other method parameters
- Restores MethodAuthorizationContext's immutability

Closes spring-projectsgh-9591
akohli96 pushed a commit to akohli96/spring-security that referenced this issue Aug 25, 2021
@jzheaux
Add AfterMethodAuthorizationManager
5714d57 
- Removes the need to keep MethodAuthorizationContext#returnObject
in sync with other method parameters
- Restores MethodAuthorizationContext's immutability

Closes spring-projectsgh-9591
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jzheaux jzheaux

Labels
in: core An issue in spring-security-core type: enhancement A general enhancement
Projects
None yet
Milestone
5.5.0-RC1
Development

No branches or pull requests
1 participant
@jzheaux