Is there a way to use #PreAuthorize in Getters? (Spring Boot) - spring

Question

I'm trying to use different objects for different user roles.
#Component
public class TestObject {
private String name;
private String secret;
#PreAuthorize("hasRole('ADMIN')")
public String getSecret() {
return secret;
}
public void setSecret(String secret) {
this.secret = secret;
}
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
}
Is there a way to use #PreAuthorize like this?

Answer 1

You can use #PreAuthorize only in a Spring Managed Bean.
If you have to create multiple instances of an object, these instances are not managed by the application context.
If you mark a class with #Component, this becomes a Spring bean and can be injected and managed by the application context. Now, if you (not Spring) create a instance of this class, then this specific instance isn't a managed by Spring.
This means, that #PreAuthorize will not work in this instance.
One workaround is to use the SecurityContextHolder.
Something like this:
Utils.java
public class Utils {
public static boolean isAdmin() {
Collection<?extends GrantedAuthority> authorities = SecurityContextHolder.getContext()
.getAuthentication().getAuthorities();
for (GrantedAuthority authority: authorities) {
if (authority.getAuthority().equalsIgnoreCase("ADMIN")) {
return true;
}
}
return false;
}
}
TestObject.java
public class TestObject {
private String name;
private String secret;
public String getSecret() {
if(Utils.isAdmin())
return secret;
return null;
}
public void setSecret(String secret) {
this.secret = secret;
}
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
}