Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-05 09:47:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-1430: Removed caching of username in session upon failed authentication. Improved Javadoc.

Browse Source
This commit is contained in:
Luke Taylor
2010-11-26 13:58:49 +00:00
parent d64efe9747
commit 43be9ea2a4
8 changed files with 21 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openid/src/main/java/org/springframework/security/openid/OpenIDAuthenticationFilter.java
-14
View File
@@ -123,8 +123,6 @@ public class OpenIDAuthenticationFilter extends AbstractAuthenticationProcessing
if (!StringUtils.hasText(identity)) {
String claimedIdentity = obtainUsername(request);
// Make the username available to the view
setLastUsername(claimedIdentity, request);
try {
String returnToUrl = buildReturnToUrl(request);
@@ -159,21 +157,9 @@ public class OpenIDAuthenticationFilter extends AbstractAuthenticationProcessing
// delegate to the authentication provider
Authentication authentication = this.getAuthenticationManager().authenticate(token);
if (authentication.isAuthenticated()) {
setLastUsername(token.getIdentityUrl(), request);
}
return authentication;
}
private void setLastUsername(String username, HttpServletRequest request) {
HttpSession session = request.getSession(false);
if (session != null || getAllowSessionCreation()) {
request.getSession().setAttribute(UsernamePasswordAuthenticationFilter.SPRING_SECURITY_LAST_USERNAME_KEY, username);
}
}
protected String lookupRealm(String returnToUrl) {
String mapping = realmMapping.get(returnToUrl);