[SOLVED] spring security : Why can't we access Hibernate entitiy parameters in @PreAuthorize?

spring security : Why can't we access Hibernate entitiy parameters in @PreAuthorize?

I have the following interface method on which I am applying @PreAuthorize :

@PreAuthorize("doSomething(#user.id)")
void something(User user, List<User> accessList);

where User is a Hibernate entity object. It gives me an error :

org.springframework.expression.spel.SpelEvaluationException: EL1007E:(pos 13): Field or property 'id' cannot be found on null at org.springframework.expression.spel.ast.PropertyOrFieldReference.readProperty(PropertyOrFieldReference.java:204)

There is no way that the user parameter is null, as if I remove the annotation, and inspect the value of user in the method that implements this interface method, there is a valid User object present there. Additionally, just before calling this method, I have made sure that the user object is correctly constructed.

I really can't figure out why would the user field be considered null by the SPEL parser

Solution

You can check with the debugger what's going on in MethodSecurityEvaluationContext, inside Object lookupVariable(String name) method:

    @Override
    public Object lookupVariable(String name) {
    Object variable = super.lookupVariable(name);

    if (variable != null) {
        return variable;
    }

    if (!argumentsAdded) {
        addArgumentsAsVariables();
        argumentsAdded = true;
    }

and so you can see what's really going on in the addArgumentsAsVariables() method as the convertion of method arguments to SPEL variables is implemented very clearly in Spring.