asmhatre/spring-security-demo
1
0
Fork 0
Code Activity

Split into per-article modules and add the method-security module

Browse Source 
Moves the existing virtual-thread/context-propagation project into
context-propagation/ and adds method-security/ for the Spring Security 7
method-security article: nine runnable demos, fourteen assertions, and every
transcript the article quotes, regenerated by scripts/run-all.sh.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RSrsDSRKVsY588yFiMJMo9
This commit is contained in:
asmhatre
2026-08-25 02:01:29 +00:00
parent 9f950bffa9
commit 5e9e7f1b12
65 changed files with 4088 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
method-security/docs/output/demo2.txt Normal file
View File

@@ -0,0 +1,27 @@
==============================================================================
Demo 2 -- self-invocation: the annotation is there, the check is not
==============================================================================
SLF4J(W): No SLF4J providers were found.
SLF4J(W): Defaulting to no-operation (NOP) logger implementation
SLF4J(W): See https://www.slf4j.org/codes.html#noProviders for further details.
alice has ROLE_USER only. adminReport() requires ROLE_ADMIN.
------------------------------------------------------------
reports.adminReport() (via proxy) DENIED -> AuthorizationDeniedException: Access Denied
reports.userEntryPoint() (this.adminReport()) ALLOWED -> TOP SECRET REVENUE NUMBERS
Is the annotation actually there? (reflection on the target class)
------------------------------------------------------------------
ReportService.adminReport() @PreAuthorize -> @org.springframework.security.access.prepost.PreAuthorize("hasRole('ADMIN')")
bean is an AOP proxy -> true
proxy class -> com.ankurm.methodsec.Demo2SelfInvocation$ReportService$$SpringCGLIB$$0
target class -> com.ankurm.methodsec.Demo2SelfInvocation$ReportService
The annotation is present, the bean IS proxied, and the call was still
not checked. The proxy only sees calls that arrive from outside.
Three ways to make the inner call go through the proxy
------------------------------------------------------
self-injection (ObjectProvider) DENIED -> AuthorizationDeniedException: Access Denied
AopContext.currentProxy() DENIED -> AuthorizationDeniedException: Access Denied
call a different bean (collaborator) DENIED -> AuthorizationDeniedException: Access Denied