Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-06 02:08:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

SessionManagementConfigurer properly defaults SecurityContextRepository

Browse Source 
Previously the default was an HttpSessionSecurityContextRepository which
meant that if a stateless authentication occurred the SecurityContext would
be lost on ERROR dispatch.

This commit ensures that the RequestAttributeSecurityContextRepository is
also consulted by default.

Closes gh-12070
This commit is contained in:
Rob Winch
2022-10-19 22:40:31 -05:00
parent a4858d9eaa
commit 9cb668aec2
3 changed files with 109 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/src/test/java/org/springframework/security/test/web/support/WebTestUtilsTests.java
+2 -1
View File
@@ -33,6 +33,7 @@ import org.springframework.security.config.annotation.web.configuration.EnableWe
import org.springframework.security.web.DefaultSecurityFilterChain;
import org.springframework.security.web.FilterChainProxy;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.context.DelegatingSecurityContextRepository;
import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
import org.springframework.security.web.context.SecurityContextHolderFilter;
import org.springframework.security.web.context.SecurityContextPersistenceFilter;
@@ -119,7 +120,7 @@ public class WebTestUtilsTests {
public void getSecurityContextRepositorySecurityNoCsrf() {
loadConfig(SecurityNoCsrfConfig.class);
assertThat(WebTestUtils.getSecurityContextRepository(this.request))
.isInstanceOf(HttpSessionSecurityContextRepository.class);
.isInstanceOf(DelegatingSecurityContextRepository.class);
}
@Test