@PreAuthorize not working on controller using

manpreet Best Answer 3 years ago

I'm trying to use preAuthorize to protect url. Only people registered in the course can access the course. Here is my code:

Controller:

@Controller
@RequestMapping(value = "/course/{courseId}")
@PreAuthorize("@userService.isCurrentUserinCourse(authentication, courseId)")
public class SyllabusController {
    @RequestMapping(value = { "/syllabus" }, method = RequestMethod.GET)
    public ModelAndView syllabusPage(@PathVariable("courseId") int courseId) {
    ...}

UserServiceImpl:

@Service("userService")
public class UserServiceImpl implements UserService {
    @Autowired
    private UserDAO userDAO;
    @Override
    public boolean isUserinCourse(int userId, int courseId) {
        return userDAO.isUserinCourse(userId, courseId);
    }

    @Override
    public boolean isCurrentUserinCourse(Authentication authentication, int courseId) {
    if (!(authentication instanceof AnonymousAuthenticationToken)) {
            return isUserinCourse(((UserModel) authentication.getPrincipal()).getId(), courseId);
    }
    return false;
}

spring-security.xml:

<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd">
<global-method-security pre-post-annotations="enabled" />

<http auto-config="true" use-expressions="true">

and we I go to /course/{id}/syllabus without out login, it shows the page where it should not. And debug is not go into isCurrentUserinCourse(Authentication authentication, int courseId) method in UserServiceImpl. where

manpreet 3 years ago

@PreAuthorize("@userService.isCurrentUserinCourse(authentication, courseId)")

SecurityContextHolder.getContext().getAuthentication()

    @PreAuthorize("@userService.isCurrentUserinCourse(#courseId)")
    @RequestMapping(value = { "/syllabus" }, method = RequestMethod.GET)
    public ModelAndView syllabusPage(@PathVariable("courseId") int courseId) {
    ...}