Methods annotated with @PostFilter are processed twice by PostFilterAuthorizationMethodInterceptor about spring-security HOT 5 CLOSED

@RADickinson, thanks for this report. I had hoped to get a fix out in time for the release this morning; however it will need to wait until the next release.

In the meantime, it is permissible to continue using @EnableGlobalMethodSecurity while upgrading as it is not removed in Spring Security 6, only deprecated.

from spring-security.

Hi @kse-music, thanks for the report. I believe this is a duplicate of #15608.

Would you please wait for #15608 to be fixed and check if it fixes the problem?

from spring-security.

Hi @marcusdacoregio
Thanks for looking at this.
I think @kse-music has provided a suggested fix to this issue.
I did notice #15608 just after I raised this issue but unfortunately I don't think I can verify the fix to 15608 will fix my issue. It looks like the target version for that fix is 6.4.0, and as I mentioned in the bug description, I am trying to apply the pre-migration changes suggested for 5.8 in order to allow us to migrate to Spring Security 6. I think we need this fix in a 5.8.x version in order to allow us to complete the pre-migration steps, and once that is working we can look at migrating. Hope that makes sense.
Thanks
Rob

from spring-security.

Closed in 5c604b9

from spring-security.

Thanks @jzheaux for fixing this issue.

from spring-security.