Request body is not present in SecurityRule

[tcrespog]

Task List

• Steps to reproduce provided
• Example that reproduces the problem uploaded to Github
• Full description of the issue provided (see below)

Steps to Reproduce

1. Download the example application.
2. Run the PetControllerTest, which performs a request to an endpoint secured with a CustomSecurityRule.
3. The CustomSecurityRule throws an exception because it expects the request body to be present (but it's not).

Expected Behaviour

The request body should be populated by the time the security rule is processed.

Actual Behaviour

The request body is not populated by the time the security rule is processed.

I have a custom SecurityRule which reads data from the request body. However, when upgrading the app to Micronaut 2.5.6, I've realized that the body is not present in the request by the time the security rule is executed.
Apparently, this is happening since Micronaut 2.5.0.

Environment Information

• Micronaut Version: 2.5.6
• JDK Version: 11

Example Application

• https://github.com/tcrespog/mn-security-rule-body

[tcrespog]

I found this PR which explains the change of behavior: micronaut-projects/micronaut-core#5261.

Now I understand that the absence of body in filters is intentional, therefore it won't be present in security rules as they are executed in the SecurityFilter.

Alternatively to security rules, AOP Around Advice could be a way of handling the case described in this issue as suggested by this comment: #649 (comment).
Am I right?

Thanks.

[sdelamo]

Yes, the absence of body in filters is intentional.

[sdelamo]

Alternatively to security rules, AOP Around Advice could be a way of handling the case described in this issue as suggested by this comment: #649 (comment).

Yes, I am going to write a documentation snippet. We should have clarified this.

[sdelamo]

I am closing this issue. I have added a documentation snippet which explains that you cannot read HTTP Body from a SecurityRule