1
0
mirror of synced 2026-08-04 17:27:13 +00:00

Revert "Support SpEL Returning AuthorizationDecision"

This reverts commit 77f2977c55.
This commit is contained in:
Josh Cummings
2024-04-04 11:31:45 -06:00
parent 77f2977c55
commit 0a9c482f62
28 changed files with 199 additions and 520 deletions
@@ -1215,42 +1215,6 @@ Spring Security will invoke the given method on that bean for each method invoca
What's nice about this is all your authorization logic is in a separate class that can be independently unit tested and verified for correctness.
It also has access to the full Java language.
[TIP]
In addition to returning a `Boolean`, you can also return `null` to indicate that the code abstains from making a decision.
If you want to include more information about the nature of the decision, you can instead return a custom `AuthorizationDecision` like this:
[tabs]
======
Java::
+
[source,java,role="primary"]
----
@Component("authz")
public class AuthorizationLogic {
public AuthorizationDecision decide(MethodSecurityExpressionOperations operations) {
// ... authorization logic
return new MyAuthorizationDecision(false, details);
}
}
----
Kotlin::
+
[source,kotlin,role="secondary"]
----
@Component("authz")
open class AuthorizationLogic {
fun decide(val operations: MethodSecurityExpressionOperations): AuthorizationDecision {
// ... authorization logic
return MyAuthorizationDecision(false, details)
}
}
----
======
Then, you can access the custom details when you <<fallback-values-authorization-denied, customize how the authorization result is handled>>.
[[custom-authorization-managers]]
=== Using a Custom Authorization Manager