SEC-663: Added null check for pre-authenticated principal value (and skip authentication attempt if null).

2026-08-01 07:47:03 +00:00 · 2008-02-04 19:36:44 +00:00
parent 3f1ab233dc
commit 600ab04cc7
1 changed files with 8 additions and 0 deletions
@@ -74,6 +74,14 @@ public abstract class AbstractPreAuthenticatedProcessingFilter extends SpringSec
        Object principal = getPreAuthenticatedPrincipal(httpRequest);
        Object credentials = getPreAuthenticatedCredentials(httpRequest);

+        if (principal == null) {
+            if (logger.isDebugEnabled()) {
+                logger.debug("No pre-authenticated principal found in request");
+            }
+
+            return;            
+        }
+
        if (logger.isDebugEnabled()) {
            logger.debug("preAuthenticatedPrincipal = " + principal + ", trying to authenticate");
        }