SEC-31: Consider returning a Vote object in AccessDecisionVoter interface about spring-security HOT 1 CLOSED

Ben Alex said:

Creating an AccessDeniedException is the responsibility of the AccessDecisionManager, not the AccessDecisionVoter. A complicating factor is if multiple votes to grant and deny are received concurrently – what should the exception message comprise?

A solution might be to develop an AccessDecisionManager that can accept a list of AccessDecisionVoters, together with a message code (for lookup from a resource bundle) that is used in the event of a vote to deny access. The deny access votes could then be concatenated into the exception text. This approach avoids the need to break backward compatibility by modifying the existing integer-based voting mechanism.

from spring-security.