Use of CGLib proxies is only auto-configured when AspectJ is on the classpath

[amarkevich]

Spring Boot version: 2.1.9.RELEASE, 2.2.0.RELEASE
Sample project: https://github.com/amarkevich/spring-boot-jwt-test

There are 2 REST controllers: without @PreAuthorize annotation (v1) and with it (v2).
v1 service calls passed;
v2 failed with different errors.

Workaround: add spring-boot-starter-aop as runtime dependency.

Its not clear whats wrong with initial project setup.

[amarkevich]

mvn test -Dtest=ApplicationTest#getPlainPreAuthorize

without spring-boot-starter-aop:

o.s.web.client.RestTemplate              : HTTP GET http://localhost:16652/jwks.json
o.s.web.client.RestTemplate              : Accept=[text/plain, application/json, application/*+json, */*]
o.s.web.servlet.DispatcherServlet        : GET "/jwks.json", parameters={}
s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to public org.springframework.http.ResponseEntity<byte[]> com.wedextim.spring.boot.application.openapi.OpenAPIController.get(java.util.Map<java.lang.String, java.lang.String>,javax.servlet.http.HttpServletRequest)
o.s.w.s.m.m.a.HttpEntityMethodProcessor  : Using 'application/json;charset=UTF-8', given [application/json;charset=UTF-8] and supported [application/octet-stream, */*, application/json, application/*+json, application/json, application/*+json]
o.s.w.s.m.m.a.HttpEntityMethodProcessor  : Writing [[B@6db94438]
o.s.web.servlet.DispatcherServlet        : Completed 200 OK
o.s.web.client.RestTemplate              : Response 200 OK
o.s.web.client.RestTemplate              : Reading to [java.lang.String] as "application/json;charset=UTF-8"
o.s.web.servlet.DispatcherServlet        : GET "/v2", parameters={}
s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to public abstract java.lang.String com.wedextim.spring.boot.application.controller.ControllerPreAuthorize.getPlain()
o.s.web.servlet.DispatcherServlet        : Failed to complete request: org.springframework.security.access.AccessDeniedException: Access is denied
o.s.web.servlet.DispatcherServlet        : GET "/v2", parameters={}
s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to public abstract java.lang.String com.wedextim.spring.boot.application.controller.ControllerPreAuthorize.getPlain()
o.s.w.s.v.ContentNegotiatingViewResolver : View remains unresolved given [text/plain]
o.s.w.servlet.view.InternalResourceView  : View name '1,2,3', model {}
o.s.w.servlet.view.InternalResourceView  : Forwarding to [1,2,3]
o.s.web.servlet.DispatcherServlet        : "FORWARD" dispatch for GET "/1,2,3", parameters={}
o.s.w.s.handler.SimpleUrlHandlerMapping  : Mapped to ResourceHttpRequestHandler ["classpath:/META-INF/resources/", "classpath:/resources/", "classpath:/static/", "classpath:/public/", "/"]
o.s.w.s.r.ResourceHttpRequestHandler     : Resource not found
o.s.web.servlet.DispatcherServlet        : Exiting from "FORWARD" dispatch, status 404
o.s.web.servlet.DispatcherServlet        : Completed 404 NOT_FOUND
o.s.web.servlet.DispatcherServlet        : "ERROR" dispatch for GET "/error", parameters={}
s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to public org.springframework.http.ResponseEntity<java.util.Map<java.lang.String, java.lang.Object>> org.springframework.boot.autoconfigure.web.servlet.error.BasicErrorController.error(javax.servlet.http.HttpServletRequest)
o.s.w.s.m.m.a.HttpEntityMethodProcessor  : Using 'text/plain', given [text/plain] and supported [text/plain]
.w.s.m.s.DefaultHandlerExceptionResolver : Resolved [org.springframework.web.HttpMediaTypeNotAcceptableException: Could not find acceptable representation]
o.s.web.servlet.DispatcherServlet        : Exiting from "ERROR" dispatch, status 406

with spring-boot-starter-aop:

o.s.web.client.RestTemplate              : HTTP GET http://localhost:5645/jwks.json
o.s.web.client.RestTemplate              : Accept=[text/plain, application/json, application/*+json, */*]
o.s.web.servlet.DispatcherServlet        : GET "/jwks.json", parameters={}
s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to public org.springframework.http.ResponseEntity<byte[]> com.wedextim.spring.boot.application.openapi.OpenAPIController.get(java.util.Map<java.lang.String, java.lang.String>,javax.servlet.http.HttpServletRequest)
o.s.w.s.m.m.a.HttpEntityMethodProcessor  : Using 'application/json;charset=UTF-8', given [application/json;charset=UTF-8] and supported [application/octet-stream, */*, application/json, application/*+json, application/json, application/*+json]
o.s.w.s.m.m.a.HttpEntityMethodProcessor  : Writing [[B@7133e479]
o.s.web.servlet.DispatcherServlet        : Completed 200 OK
o.s.web.client.RestTemplate              : Response 200 OK
o.s.web.client.RestTemplate              : Reading to [java.lang.String] as "application/json;charset=UTF-8"
o.s.web.servlet.DispatcherServlet        : GET "/v2", parameters={}
s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to public java.lang.String com.wedextim.spring.boot.application.controller.impl.ControllerPreAuthorizeImpl.getPlain()
o.s.web.servlet.DispatcherServlet        : Failed to complete request: org.springframework.security.access.AccessDeniedException: Access is denied
o.s.web.servlet.DispatcherServlet        : GET "/v2", parameters={}
s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to public java.lang.String com.wedextim.spring.boot.application.controller.impl.ControllerPreAuthorizeImpl.getPlain()
m.m.a.RequestResponseBodyMethodProcessor : Using 'text/plain', given [text/plain] and supported [text/plain]
m.m.a.RequestResponseBodyMethodProcessor : Writing ["1,2,3"]
o.s.web.servlet.DispatcherServlet        : Completed 200 OK

[wilkinsona]

Thanks for the sample.

The problem is caused by proxying and the different behaviour of JDK-based proxies and CGLib-based proxies. When spring-boot-starter-aop is on the classpath, Spring Boot auto-configures the use of CGLib-based proxies. Without it JDK-based proxies are used. When JDK-based proxies are used, annotations on an implemented interface, Controller in your case, cannot be found and as a result the request mapping are not discovered. When CGLib-based proxies are used annotations on an implemented interface can be found and the request mappings are discovered. This is mentioned in Spring MVC's reference documentation.

You can fix the problem with your sample application by configuring global method security to use CGLib-based proxies using the proxyTargetClass attribute. In the case of your sample, that would result in the annotation looking like the following:

@EnableGlobalMethodSecurity(prePostEnabled = true, proxyTargetClass = true)

I'm going to leave this issue open for now as I'd like us to revisit when we auto-configure the use of CGLib-based proxies. It feels like it may be unnecessarily coupled to the use of spring-boot-starter-aop and the presence of AspectJ on the classpath at the moment.

[wilkinsona]

This might not be as easy to fix as we'd hoped. The javadoc for @EnableAspectJAutoProxy says the following:

This feature requires the presence of aspectjweaver on the classpath. While that dependency is optional for spring-aop in general, it is required for @EnableAspectJAutoProxy and its underlying facilities.

Our end goal is for everything, and in this particular case global method security, to use CGLib-based proxies by default. I'm not yet sure how to do that without using @EnableAspectJAutoProxy and, therefore, requiring aspectjweaver.