How to skip PreAuthorize in Java if the SpEL execution fails?

Question

I have protected my API endpoints using some custom SpEL functions. However, since using SpEL in @PreAuthorize can lead to run time errors due to exceptions in constructing the SpEL expression. I would like to make @PreAuthorize return true when an SPELExecutionException occurs.

Answer 1

Since @PreAuthorize is used to validate if the requestor has the required authorization, It doesn't make any sense for the user to by-pass this security mechanism in case of system errors.

You can still by-pass this. Have a look at the snippet below: Just a correction it is SpEL

@PostMapping()
@PreAuthorize("#{@someBean.validateAccess('HAS_ACCESS_TO_MY_METHOD')}")
public ResponseEntity<?> myMethod(@RequestBody final MyRequestBody requestBody) {       
    //some logic
}

@Service
public class SomeBean {

    public boolean validateAccess(String permission){
        boolean isAuthorized = false;
        try{
             //some logic to authorize
             // set the hasAccess variable to true or false based on your logic
             isAuthorized = true;
        } catch (Exception e) {
             // if some exception occurs set it to true
            isAuthorized = true;
        }
        return isAuthorized;
    }
}