Bean validation is executed before @PreAuthorize

@RestController
public class SomeController {

    @PreAuthorize("@security.isAuthenticated()")
    @PostMapping("/todo")
    public void add(@Valid @RequestBody dto: SomeDto) {
    }
}

Method isAuthenticated should be executed before deserialization and validation of action parameters.

[ghost]

I think everybody agree with the simply rule “Security First” . Sorry but for me this is a big issue why do we want to run the validation and return validation error if somebody has not event permission to this endpoint? Also the explanation for me its not professional, its sound like “we don’t care with the basic security rules the design is more important than the security”.

Now how we can be confident by using spring security once we know that we can run some other methods before we actually authorise user. The simple question after all is: what else other than validation is running before security check ?

[ghost]

@wilkinsona sorry for that I just want to express that I really dislike this behaviour. I updated my comment so now I hope is fine. I will definitely raise this ticket with spring security team and chat with them on Gitter.