Richard Zowalla created TOMEE-4730:
--------------------------------------
Summary: MP-JWT ignores class-level security annotations of a
resource superclass
Key: TOMEE-4730
URL: https://issues.apache.org/jira/browse/TOMEE-4730
Project: TomEE
Issue Type: Bug
Reporter: Richard Zowalla
Assignee: Richard Zowalla
Fix For: 11.0.0, 10.3.0
MPJWTSecurityAnnotationsInterceptorsFeature only reads @RolesAllowed,
@PermitAll and @DenyAll from ResourceInfo.getResourceClass\(\). These
annotations are not @Inherited, so when a base resource class carries a
class\-level constraint and a subclass without its own annotation exposes a
method inherited from that base, the base class constraint is not applied and
the endpoint is unprotected. Class\-level annotations of the class that
declares the method should be taken into account, following the Jakarta
Annotations inheritance rules.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
