Adding spring-security annotations such as @PreAuthorize to the generated ImplBase classes has no effect.
While grpc-spring supports spring-security, and these annotations work with output generated by grpc-java, when added to the wire generated classes the annotations are ignored.
There are comments in grpc-spring that outline the issue:
// The #bindService() method uses a reference to 'this', which will be used to invoke the methods.
// If the method is not final it will delegate to the original instance and thus it will bypass any security layer that
// you intend to add, unless you re-implement the #bindService() method on the outermost layer (which Spring does not).
This issue is related to the current open PR:
#5
Adding spring-security annotations such as
@PreAuthorizeto the generatedImplBaseclasses has no effect.While grpc-spring supports spring-security, and these annotations work with output generated by grpc-java, when added to the wire generated classes the annotations are ignored.
There are comments in grpc-spring that outline the issue:
This issue is related to the current open PR:
#5