Skip to content

setPostAuthenticationChecks in AbstractUserDetailsReactiveAuthenticationManager validates the field instead of the parameter #19276

Description

@big-cir

Describe the bug

The null check in AbstractUserDetailsReactiveAuthenticationManager#setPostAuthenticationChecks asserts the current field value instead of the parameter:

public void setPostAuthenticationChecks(UserDetailsChecker postAuthenticationChecks) {
    Assert.notNull(this.postAuthenticationChecks, "postAuthenticationChecks cannot be null");
    this.postAuthenticationChecks = postAuthenticationChecks;
}

Since the field is initialized to a default checker, the assertion always passes, so null is silently accepted and the next authenticate(...) call fails with a raw NullPointerException at .doOnNext(this.postAuthenticationChecks::check) instead of failing fast with a clear message.

All other setters in the same class (setPasswordEncoder, setScheduler, setUserDetailsPasswordService, setMessageSource) validate the parameter.

To Reproduce

UserDetailsRepositoryReactiveAuthenticationManager manager =
        new UserDetailsRepositoryReactiveAuthenticationManager(userDetailsService);
manager.setPostAuthenticationChecks(null); // no exception
manager.authenticate(token).block();       // NullPointerException

Expected behavior

setPostAuthenticationChecks(null) should throw IllegalArgumentException("postAuthenticationChecks cannot be null").

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions