Secured annotation isn't applied to HttpServerFilter

[ThraaxSession]

Expected Behavior

A HttpServerFilter class can be annotated with "@Secured".

Actual Behaviour

The annotation will be ignored

Steps To Reproduce

Environment Information

GraalVM 22.2.0.r11

Example Application

No response

Version

3.6.0

[jameskleeh]

What gave you the impression this should work?

[ThraaxSession]

Hi @jameskleeh I see HttpServerFilter like a superset on HTTP requests over HTTP Controller. Why it shouldn't be possible to secure this superset? A controller might be more specific endpoints. But the the filters can handle the same as far I figure out. Especially when I need more control over the request. That's why I think it should be possible to secure HttpServerFilter. If Secured annotation is Controller specific, it would be at least useful to have possibility to extend the Filter annotation.

[ThraaxSession]

@jameskleeh what is the alternative for now? I need this annotation. How can I manually check it?

[jameskleeh]

Ensure it runs after the secured one and get the authentication from the request

On Sat, Aug 20, 2022 at 7:16 AM ThraaxSession @.***> wrote:

@jameskleeh https://github.com/jameskleeh what is the alternative for now? I need this annotation. How can I manually check it?

— Reply to this email directly, view it on GitHub https://github.com/micronaut-projects/micronaut-core/issues/7872#issuecomment-1221295999, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAMCVLPR7IDBQKKAHTHX3E3V2C5CFANCNFSM56NAHHJA . You are receiving this because you were mentioned.Message ID: @.***>

[ThraaxSession]

@jameskleeh any example?

[ThraaxSession]

Hi @jameskleeh the latest release of micronaut (I guess) security provides for the request new parameters. A first help to solve the authentication issue. Might be to add "request.isAuthenticated". The annotation is still anyway a smoother solution.

[ThraaxSession]

@jameskleeh any update on this?

[yawkat]

james doesn't work on micronaut full-time anymore.

if you want to check for authentication, you can add your filter after the SecurityFilter, and check the SecurityFilter.AUTHENTICATION attribute. I don't think we should implement the annotation for filters, it'd be like filters for filters, which is just weird.

[jameskleeh]

@yawkat Agreed this should be closed imo