spring security : Why can't we access Hibernate entitiy parameters in @PreAuthorize?

Question

I have the following interface method on which I am applying @PreAuthorize :

@PreAuthorize("doSomething(#user.id)")
void something(User user, List<User> accessList);

where User is a Hibernate entity object. It gives me an error :

org.springframework.expression.spel.SpelEvaluationException: EL1007E:(pos 13): Field or property 'id' cannot be found on null at org.springframework.expression.spel.ast.PropertyOrFieldReference.readProperty(PropertyOrFieldReference.java:204)

There is no way that the user parameter is null, as if I remove the annotation, and inspect the value of user in the method that implements this interface method, there is a valid User object present there. Additionally, just before calling this method, I have made sure that the user object is correctly constructed.

I really can't figure out why would the user field be considered null by the SPEL parser

Answer 1

You can check with the debugger what's going on in MethodSecurityEvaluationContext, inside Object lookupVariable(String name) method:

    @Override
    public Object lookupVariable(String name) {
    Object variable = super.lookupVariable(name);

    if (variable != null) {
        return variable;
    }

    if (!argumentsAdded) {
        addArgumentsAsVariables();
        argumentsAdded = true;
    }

and so you can see what's really going on in the addArgumentsAsVariables() method as the convertion of method arguments to SPEL variables is implemented very clearly in Spring.