-
Notifications
You must be signed in to change notification settings - Fork 6.2k
Deprecate Authorization Logic that uses FilterInvocation
#17884
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Closes: spring-projectsgh-17781 Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
However, I believe that we can also replace SecurityExpressionHandler<FilterInvocation> in favor of SecurityExpressionHandler<RequestAuthorizationContext> in the AbstractAuthorizeTag and JspAuthorizeTag classes.
However, there is a nuance: in FilterInvocation, if we pass request parameters, a DummyRequest is created that inherits from HttpServletRequestWrapper. We could introduce the same class and pass it to RequestAuthorizationContext. What do you think about this? Where should we place such a class? I think in our case it would be enough to copy it from FilterInvocation directly into AbstractAuthorizeTag.
Hi, @therepanic, thanks for the PR. Can you clarify where it is that the dummy request is created, as far as JSP Tag usage is concerned? I imagine that an evaluating tag would have access to the original HttpServletRequest and not need a wrapper dummy request.
I agree that this is used in the default WebInvocationPrivilegeEvaluator; however, I believe that is the extent of it.
Closes: gh-17781