spring - How springSecurityFilterChain Skips Authentication for already logged in requests -

-

i have been working on spring security, , working well. went debugging how works. filters configured springsecurityfilterchain via http namespace. 1 of them authentication filter providing authentication. found when new login request comes(no previous session) authentication filter invoked, when request comes logged in user, i.e, session existing, authenticationfilter not invoked. coudn't find , how 'springsecurity' skips authentication logged in requests. please me understand this.

thanks

i think sessionmanagementfilter takes care of this:

        if (!securitycontextrepository.containscontext(request)) {         authentication authentication = securitycontextholder.getcontext().getauthentication();          if (authentication != null && !authenticationtrustresolver.isanonymous(authentication)) {          // user has been authenticated during current request, call session strategy             try {                 sessionauthenticationstrategy.onauthentication(authentication, request, response);             } catch (sessionauthenticationexception e) {                 // session strategy can reject authentication                 logger.debug("sessionauthenticationstrategy rejected authentication object", e);                 securitycontextholder.clearcontext();                 failurehandler.onauthenticationfailure(request, response, e);                  return;             }             // eagerly save security context make available possible re-entrant             // requests may occur before current request completes. sec-1396.             securitycontextrepository.savecontext(securitycontextholder.getcontext(), request, response);         } else {          // no security context or authentication present. check session timeout             if (request.getrequestedsessionid() != null && !request.isrequestedsessionidvalid()) {                 if(logger.isdebugenabled()) {                     logger.debug("requested session id " + request.getrequestedsessionid() + " invalid.");                 }                  if (invalidsessionstrategy != null) {                     invalidsessionstrategy.oninvalidsessiondetected(request, response);                     return;                 }             }         }     }

of course there's more here meets eye. authentication stored in threadlocal:

in spring security, responsibility storing securitycontext between requests falls securitycontextpersistencefilter, default stores context httpsession attribute between http requests. restores context securitycontextholder each request and, crucially, clears securitycontextholder when request completes. shouldn't interact directly httpsession security purposes. there no justification doing - use securitycontextholder instead.

so it's responsibility of securitycontextpersistencefilter load context data (and erase later), other modules down filter chain make decisions based on data. (for example skip or authentication via usermanager service)

i'm not springsecurity developer, take info educated guess :)


Comments

Post a Comment

Popular posts from this blog

c# - SVN Error : "svnadmin: E205000: Too many arguments" -

-
i trying reposotries using c# code process svncommand = null; var psi = new processstartinfo("svnadmin"); psi.redirectstandardoutput = true; psi.redirectstandarderror = true; psi.useshellexecute = false; psi.arguments= @"dump c:\repositories\myrepo > c:\temp\myrepodumpfile.dump"; using (svncommand = process.start(psi)) { var myoutput = svncommand.standardoutput; var myerror = svncommand.standarderror; debug.write("output :" + environment.newline + environment.newline + myoutput.readtoend() + environment.newline + "error :" + environment.newline + environment.newline + myerror.readtoend()); svncommand.close(); } when use dump command commandline svnadmin dump c:\repositories\myrepo > c:\temp\myrepodumpfile.dump it works fine when try ...
Read more

c# - Copy ObservableCollection to another ObservableCollection -

-
how copy observablecollection item observablecollection without reference of first collection? here observablecollection item value changes affecting both collections. code private observablecollection<ratemodel> _allmetalrate = new observablecollection<ratemodel>(); private observablecollection<ratemodel> _metalrateondate = new observablecollection<ratemodel>(); public observablecollection<ratemodel> allmetalrate { { return this._allmetalrate; } set { this._allmetalrate = value; notifypropertychanged("metalrate"); } } public observablecollection<ratemodel> metalrateondate { { return this._metalrateondate; } set { this._metalrateondate = value; notifypropertychanged("metalrateondate"); } } foreach (var item in metalrateondate) allmetalrate.add(item); what causing , how can solve it? you need clone object referenced item before it's a...
Read more

All overlapping substrings matching a java regex -

-
is there api method returns (possibly overlapping) substrings match regular expression? for example, have text string: string t = 04/31 412-555-1235; , , have pattern: pattern p = new pattern("\\d\\d+"); matches strings of 2 or more characters. the matches are: 04, 31, 412, 555, 1235. how overlapping matches? i want code return: 04, 31, 41, 412, 12, 55, 555, 55, 12, 123, 1235, 23, 235, 35. theoretically should possible -- there obvious o(n^2) algorithm enumerates , checks substrings against pattern. edit rather enumerating substrings, safer use region(int start, int end) method in matcher . checking pattern against separate, extracted substring might change result of match (e.g. if there non-capturing group or word boundary check @ start/end of pattern). edit 2 actually, it's unclear whether region() expect zero-width matches. specification vague, , experiments yield disappointing results. for example: string line = "xx90xx"; strin...
Read more