Describe the bug
If I use @PreAuthorize
, the validation for @RequestParam
does not work.
To Reproduce
//-----------------------------------------------------
// With PreAuthorize: Validation does NOT work
//-----------------------------------------------------
@GetMapping("withPreAuthorize")
@ResponseStatus(HttpStatus.OK)
@PreAuthorize("hasRole('USER')")
suspend fun withPreAuthorize(
@RequestParam(defaultValue = "100", required = true) @Min(1) @Max(100) limit: Int,
): String {
return "OK"
}
//-----------------------------------------------------
// Without PreAuthorize: Validation works
//-----------------------------------------------------
@GetMapping("withoutPreAuthorize")
@ResponseStatus(HttpStatus.OK)
suspend fun withoutPreAuthorize(
@RequestParam(defaultValue = "100", required = true) @Min(1) @Max(100) limit: Int,
): String {
return "OK"
}
Expected behavior
A clear and concise description of what you expected to happen.
@PreAuthorize
should not disturb validator.
Sample https://github.com/und3rs/springboot-helpme You can test with '\src\test\kotlin\test.http'.
Comment From: scottfrederick
@und3rs Please don't cross-post the same issue to multiple projects. This can cause wasted time when multiple people try to track down the source of the problem.
Closing in favor of https://github.com/spring-projects/spring-security/issues/10470.