DenyAllPermissionEvaluator Used As Silent Backup When Two PermissionEvaluator Beans Exist

[dcarrol3]

When two or more PermissionEvaluator beans are present in an application, Spring seems to silently choose the DenyAllPermissionEvaluator instead of failing to startup due to having duplicate beans.

This feels like a bug, and could have dangerous consequences for enterprises by silently pushing out code to production that seems to build/run as expected, but once an endpoint is hit that calls hasPermission(), it is always denied.

I think Spring should be failing at startup if there are multiple PermissionsEvaluators similar to behavior for other duplicate beans, or otherwise clearly warn developers of the case.

[wilkinsona]

Thanks for the report but this is out of Spring Boot's control. The default DenyAllPermissionEvaluator is being used due to this logic in Spring Security. With no unique PermissionEvaluator, null is returned which results in the default being used.

If you think this could be improved, please open a Spring Security issue.

[dcarrol3]

Thanks. I'll open an issue over there.