asmhatre
5e9e7f1b12
Moves the existing virtual-thread/context-propagation project into context-propagation/ and adds method-security/ for the Spring Security 7 method-security article: nine runnable demos, fourteen assertions, and every transcript the article quotes, regenerated by scripts/run-all.sh. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RSrsDSRKVsY588yFiMJMo9
28 lines
1.8 KiB
Plaintext
28 lines
1.8 KiB
Plaintext
==============================================================================
|
|
Demo 2 -- self-invocation: the annotation is there, the check is not
|
|
==============================================================================
|
|
SLF4J(W): No SLF4J providers were found.
|
|
SLF4J(W): Defaulting to no-operation (NOP) logger implementation
|
|
SLF4J(W): See https://www.slf4j.org/codes.html#noProviders for further details.
|
|
|
|
alice has ROLE_USER only. adminReport() requires ROLE_ADMIN.
|
|
------------------------------------------------------------
|
|
reports.adminReport() (via proxy) DENIED -> AuthorizationDeniedException: Access Denied
|
|
reports.userEntryPoint() (this.adminReport()) ALLOWED -> TOP SECRET REVENUE NUMBERS
|
|
|
|
Is the annotation actually there? (reflection on the target class)
|
|
------------------------------------------------------------------
|
|
ReportService.adminReport() @PreAuthorize -> @org.springframework.security.access.prepost.PreAuthorize("hasRole('ADMIN')")
|
|
bean is an AOP proxy -> true
|
|
proxy class -> com.ankurm.methodsec.Demo2SelfInvocation$ReportService$$SpringCGLIB$$0
|
|
target class -> com.ankurm.methodsec.Demo2SelfInvocation$ReportService
|
|
|
|
The annotation is present, the bean IS proxied, and the call was still
|
|
not checked. The proxy only sees calls that arrive from outside.
|
|
|
|
Three ways to make the inner call go through the proxy
|
|
------------------------------------------------------
|
|
self-injection (ObjectProvider) DENIED -> AuthorizationDeniedException: Access Denied
|
|
AopContext.currentProxy() DENIED -> AuthorizationDeniedException: Access Denied
|
|
call a different bean (collaborator) DENIED -> AuthorizationDeniedException: Access Denied
|