7

We have two service methods in two different services in our spring application which are both annotated with @Transactional(isolation = Isolation.SERIALIZABLE). Both methods read and write data to and from our DB and work with the same entities. All querying is done through spring data repositories.

Both methods also have @PreAuthorize(@customPermissionEvaluator.evaluate(...)) annotations on them which call a custom methods. Inside the permission evaluator we access the database through spring data repositories to read data as well. The permission evaluator methods themselves don't have any transactional annotations.

This pattern creates an issue for us when the two service methods which are @Transactional(isolation = Isolation.SERIALIZABLE) get called at the same time. If this happens we quickly get into data consistency issues with phantom reads (the two service methods operate on the same entities). However we get the right transaction handling as soon as we remove the @PreAuthorize annotations from both methods. It seems like the entities loaded in the @PreAuthorize might be cached by hibernate and they don't get a refresh when we query them again in the service methods.

Underneath we're running a mysql database.

Does anyone have any idea what is going on here or has anyone had a similar issue in spring before? Are there any rules/restrictions regarding data base access from custom @PreAuthorize methods? We are really lost at this point... Thanks!

Christoph Vogeler
  • 93
  • 4
  • Yes we tried making the evaluator methods transactional with isolation level serializable, unfortunately didn't help. We assume that because the PreAuthorize is an advice of spring it's not part of the same transaction. – Christoph Vogeler Aug 28 '20 at 14:56
  • try: `readOnly=true` ..and the rest to defaults, so `@Transactional(readOnly=true)` – xerx593 Aug 28 '20 at 14:59
  • no luck unfortunately – Christoph Vogeler Aug 28 '20 at 15:07
  • ..then this need an [mcve] and deeper analysis. – xerx593 Aug 28 '20 at 15:10
  • Have you tried removing `@Transactional` from the evaluator altogether? [This question](https://stackoverflow.com/questions/8856995/order-of-spring-transactional-and-spring-security-preauthorize) seems to suggest `@Transactional` aspect has higher priority than `@PreAuthorize`, so `@Transactional` on the actual service method should have you covered – crizzis Aug 29 '20 at 20:06

0 Answers0