Exceptions for Authorized Objects should propagate when returned from a Controller #17074
Conversation
spring-projects-issues
added
the
status: waiting-for-triage
evgeniycheban
force-pushed
the
gh-16058
branch
4 times, most recently
from
5e6afe3 to
fb85470
Compare
There was a problem hiding this comment.
Nice solution, @evgeniycheban! I've left a piece of feedback inline.
|
|
||
| @Bean | ||
| @Role(BeanDefinition.ROLE_INFRASTRUCTURE) | ||
| AuthorizationAdvisorProxyFactory.TargetVisitor webTargetVisitor() { | ||
| return new WebTargetVisitor(); | ||
| } | ||
|
|
||
| @Override | ||
| public void extendHandlerExceptionResolvers(List<HandlerExceptionResolver> resolvers) { | ||
| resolvers.add(0, new HttpMessageNotWritableAccessDeniedExceptionResolver()); |
There was a problem hiding this comment.
One thing that concerns me is that this might break applications that have an @ExceptionHandler for AccessDeniedException-caused HttpMessageNotWritableException already.
Further, it would be nice if there were a clear way for applications to override Security's default handling of this scenario.
There was a problem hiding this comment.
I implemented a fix for this scenario by finding the DefaultHandlerExceptionResolver's index and adding Security's ExceptionResolver before the default resolver. This way user-defined @ExceptionHandler will always take precedence and try to resolve an exception first since the ExceptionHandlerExceptionResolver is added before the extendHandlerExceptionResolvers method call. I think we could also consider providing a configuration option to control wether Spring Security should handle this type of scenario or not.
jzheaux
added
in: web
… a Controller Closes spring-projectsgh-16058 Signed-off-by: Evgeniy Cheban <[email protected]>
|
Hi @jzheaux I updated the PR, according to your feedback, thanks. |
Closes gh-16058