具有多个 HTTP 代码状态的 ResponseBodyEmitter

Question

For some security reason, we have added a common spring filter that perform a cross-cutting check and drop a 403 when a security rule is broken.

The solution is working fine in case of synchronous endpoint (ie returning a ResponseBody<SomeDTO> )

However, we have several asynchronous endpoints which return ResponseBodyEmitter .

If (checks == false){
// Then the filter should erase the response body and override the http status to 403.
}

For asynchronous method,the checks are performed during the response sending.

Hence the endpoint may send at the beginning 200 with a response body and then drops the connection with 403 and empty body.

Question: From design wise, is this behavior coherent with REST? (ie OK OK OK and then FORBIDDEN)

Answer 1

A HTTP request can only return 1 HTTP response, so "OK OK OK and then FORBIDDEN" is not actually possible. So REST doesn't care if you have some internal state that defaults to 200, eventually becomes 403 and then the last one gets sent back to the client. HTTP and REST doesn't know what goes on in your server leading to that 403.

However, if you have some mechanism that does permission checks after processing the entire request, and if the user doesn't have permission it erases the response body and sets a 403 response, that only seems reasonable for safe methods (eg: read-only methods like GET).