-
Notifications
You must be signed in to change notification settings - Fork 6.1k
Closed
Labels
in: configAn issue in spring-security-configAn issue in spring-security-configstatus: first-timers-onlyAn issue that can only be worked on by brand new contributorsAn issue that can only be worked on by brand new contributorstype: enhancementA general enhancementA general enhancement
Milestone
Description
Summary
The Kotlin DSL is designed with a specific hierarchy in mind.
However, the hierarchy is not enforced.
The following configuration should not compile, but currently it does.
@EnableWebFluxSecurity
class SecurityConfig {
@Bean
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
return http {
authorizeExchange {
authorizeExchange { }
}
}
}
}
Kotlin allows the creation of DSL markers, to control the scope in which a function is available.
We can use a DSL marker to annotate all classes that belong to the server HTTP security DSL and prevent scope leaking.
For this we will need a new DSL marker, similar to @SecurityMarker
.
A possible name for the new marker is @ServerSecurityMarker
.
See fde3ccb for the changes that introduced the @SecurityMarker
.
Metadata
Metadata
Assignees
Labels
in: configAn issue in spring-security-configAn issue in spring-security-configstatus: first-timers-onlyAn issue that can only be worked on by brand new contributorsAn issue that can only be worked on by brand new contributorstype: enhancementA general enhancementA general enhancement