From d7d844812041edd59d57ce91bcc2f671ae57e739 Mon Sep 17 00:00:00 2001
From: Luke Taylor <luke.taylor@springsource.com>
Date: Fri, 23 Jul 2010 15:59:53 +0100
Subject: [PATCH] SEC-1521: Add check for null SecurityContextRepository and
 clarify related docs on use of null implementation
 (NullSecurityContextRepository).

---
 docs/manual/src/docbook/core-filters.xml      | 21 ++++++++++---------
 .../SecurityContextPersistenceFilter.java     |  2 ++
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/docs/manual/src/docbook/core-filters.xml b/docs/manual/src/docbook/core-filters.xml
index 1523f77cf8..c8642e661a 100644
--- a/docs/manual/src/docbook/core-filters.xml
+++ b/docs/manual/src/docbook/core-filters.xml
@@ -241,17 +241,18 @@ public interface SecurityContextRepository {
                 changed). If you don't want a session to be created, then you can set this property
                 to <literal>false</literal>: <programlisting language="xml"><![CDATA[
 <bean id="securityContextPersistenceFilter"
-class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
-<property name='securityContextRepository'>
-<bean class='org.springframework.security.web.context.HttpSessionSecurityContextRepository'>
-  <property name='allowSessionCreation' value='false' />
+    class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
+  <property name='securityContextRepository'>
+    <bean class='org.springframework.security.web.context.HttpSessionSecurityContextRepository'>
+      <property name='allowSessionCreation' value='false' />
+    </bean>
+  </property>
 </bean>
-</property>
-</bean>
-]]></programlisting> Alternatively you could provide a null implementation of the
-                <interfacename>SecurityContextRepository</interfacename> interface, which will
-                prevent the security context from being stored, even if a session has already been
-                created during the request. </para>
+]]></programlisting> Alternatively you could provide an instance of
+                <classname>NullSecurityContextRepository</classname>, a <quote><link
+                xlink:href="http://en.wikipedia.org/wiki/Null_Object_pattern">null object</link></quote>
+                implementation, which will prevent the security context from being stored, even if a
+                session has already been created during the request. </para>
         </section>
     </section>
     <section xml:id="form-login-filter">
diff --git a/web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java b/web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java
index 8ecc542be8..8c79482692 100644
--- a/web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java
+++ b/web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java
@@ -12,6 +12,7 @@ import javax.servlet.http.HttpSession;
 
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.util.Assert;
 import org.springframework.web.filter.GenericFilterBean;
 
 /**
@@ -92,6 +93,7 @@ public class SecurityContextPersistenceFilter extends GenericFilterBean {
     }
 
     public void setSecurityContextRepository(SecurityContextRepository repo) {
+        Assert.notNull(repo, "SecurityContextRepository cannot be null");
         this.repo = repo;
     }