Injecting views as secured proxies cause strange side effects

[peholmst]

When adding @Secured to views, they are injected as proxies into the view provider. This causes strange side effects in the UI.

[peholmst]

This also applies to @PreAuthorize views, which essentially renders the PreAuthorizeViewInstanceAccessControl useless.

[aricooperman]

I had this issue with my views that had @PreAuthorize on them and had to change them to @secured to work as if I used PreAuthorize I get a class cast exception in PreInvocationAuthorizationAdviceVoter:

java.lang.ClassCastException: [[My View Class]] cannot be cast to org.aopalliance.intercept.MethodInvocation
    at org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter.vote(PreInvocationAuthorizationAdviceVoter.java:25) ~[spring-security-core-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:62) ~[spring-security-core-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.vaadin.spring.security.navigation.PreAuthorizeViewInstanceAccessControl.isAccessGranted(PreAuthorizeViewInstanceAccessControl.java:89) ~[vaadin-spring-ext-security-0.0.7-SNAPSHOT.jar:na]
    at com.vaadin.spring.navigator.SpringViewProvider.isAccessGrantedToViewInstance(SpringViewProvider.java:349) ~[vaadin-spring-1.0.0.jar:1.0.0]
    at com.vaadin.spring.navigator.SpringViewProvider.getViewFromApplicationContextAndCheckAccess(SpringViewProvider.java:313) ~[vaadin-spring-1.0.0.jar:1.0.0]
    at com.vaadin.spring.navigator.SpringViewProvider.getViewFromApplicationContext(SpringViewProvider.java:296) ~[vaadin-spring-1.0.0.jar:1.0.0]
    at com.vaadin.spring.navigator.SpringViewProvider.getView(SpringViewProvider.java:274) ~[vaadin-spring-1.0.0.jar:1.0.0]

I changed it back to Secured and it seems to work fine even though it is proxied

[peholmst]

The problem is that the proxied views work sometimes and sometimes not. If you refresh a page with a proxied view in it, you will sometimes get an error complaining that the proxy class is not in the widgetset. This kind of behavior cannot be accepted in a real application.

[peholmst]

Looks like CGLIB proxies work.

[aricooperman]

Yeah, mine are CGLIB as I extends a base view class. Don't seem to have any
issues unless I use @PreAuthorize

On Fri, Feb 19, 2016 at 12:10 AM Petter Holmström notifications@github.com
wrote:

Looks like CGLIB proxies work.

—
Reply to this email directly or view it on GitHub
#270 (comment)
.