Avoid literals in @PreAuthorize annotations Spring boot EL

Question

I'm currently working on avoid literals inside the security annotations. The reason is that in large applications having literals inside these annotations rely on several errors, also refactoring permissions names will be more easy.

I created a @Bean it's purpose is register the Enum packages that I want to then use in the @Preautorize annotations in this way @PreAuthorize("hasAuthority(T(Permissions).CREATE)")

@Bean
    static MethodSecurityExpressionHandler methodSecurityExpressionHandler() {
        return new DefaultMethodSecurityExpressionHandler() {
            @Override
            public StandardEvaluationContext createEvaluationContext(Supplier<Authentication> authentication,
                                                                     MethodInvocation mi) {

                StandardEvaluationContext evaluationContext =
                        (StandardEvaluationContext) super.createEvaluationContext(authentication, mi);
                ((StandardTypeLocator) evaluationContext.getTypeLocator())
                        .registerImport(PermissionName.class.getPackage().getName());

                return evaluationContext;
            }
        };
    }

but the functions T() can't resolve the class Permissions.

About the technical information I'm working on Spring Boot 3.2.4.

If you need more information or discuss about it fell free! Thanks for your help!

Answer 1

This should work:

Security config with a custom MethodSecurityExpressionHandler; note: in your code you use PermissionName instead of Permissions

@Configuration
@EnableMethodSecurity // <-- important
public class SecurityConfig {
    
    @Bean
    static MethodSecurityExpressionHandler methodSecurityExpressionHandler() {
        return new DefaultMethodSecurityExpressionHandler() {
            @Override
            public StandardEvaluationContext createEvaluationContext(Supplier<Authentication> authentication,
                                                                     MethodInvocation mi) {

                StandardEvaluationContext evaluationContext =
                        (StandardEvaluationContext) super.createEvaluationContext(authentication, mi);
                ((StandardTypeLocator) evaluationContext.getTypeLocator())
                        .registerImport(Permissions.class.getPackage().getName());

                return evaluationContext;
            }
        };
    }
    
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {

        return httpSecurity.authorizeHttpRequests(
                        auth -> {
                            auth.anyRequest().authenticated();
                        }
                )
                .formLogin(withDefaults())
                .build();
    }
    
    /* user with permission READ */
    /* admin with permissions CREATE and READ */
    @Bean
    public UserDetailsService users() {
        // The builder will ensure the passwords are encoded before saving in memory
        User.UserBuilder users = User.withDefaultPasswordEncoder();
        UserDetails user = users
                .username("user")
                .password("password")
                .roles("USER")
                .authorities("READ") // add some authorities
                .build();
        UserDetails admin = users
                .username("admin")
                .password("password")
                .roles("USER", "ADMIN")
                .authorities("READ","CREATE") // add some authorities
                .build();
        return new InMemoryUserDetailsManager(user, admin);
    }
}

The Permissions class with public accessible fields

public class Permissions {

    public static final String CREATE = "CREATE";
    public static final String READ = "READ";

    /* possible easier solution */
    public static final String CREATE_AUTH = "hasAuthority('CREATE')";
}

Usage in a Controller

@RestController
public class DemoController {

    @GetMapping("/read")
    @PreAuthorize("hasAnyAuthority(T(Permissions).READ)")
    public String read(@AuthenticationPrincipal UserDetails user) {
        return "Hello reader: %s %s".formatted(user.getUsername(), user.getAuthorities());
    }

    @GetMapping("/create")
    @PreAuthorize("hasAnyAuthority(T(Permissions).CREATE)")
    public String create(@AuthenticationPrincipal UserDetails user) {
        return "Hello creator: %s %s".formatted(user.getUsername(), user.getAuthorities());
    }

    @GetMapping("/other")
    @PreAuthorize(Permissions.CREATE_AUTH) // maybe an easier solution?
    public String other(@AuthenticationPrincipal UserDetails user) {
        return "Hello creator: %s %s".formatted(user.getUsername(), user.getAuthorities());
    }
}