Switching users creates user sessions

When upgrading to Spring Boot 2.7.11 and later we started having sessions even though we have explicitly configured the use of the SecurityContextRepository to be the NullSecurityContextRepository. We traced this to #12834.

From my analysis I can see that for #12504 a SecurityContextRepository was added to the SwitchUserFilter with the default being RequestAttributeSecurityContextRepository. Although this is different than the other filters than use the NullSecurityContextRepository as a default, it is still fine since it is not creating sessions. The other filters are:

• AbstractAuthenticationProcessingFilter
• AuthenticationFilter
• AbstractPreAuthenticatedProcessingFilter
• RememberMeAuthenticationFilter
• BasicAuthenticationFilter
• DigestAuthenticationFilter

In my opinion the change done in #12834 is backwards incompatible change since all of a sudden sessions get created. I think that the default should be the same as the other filters i.e. use NullSecurityContextRepository and if a user wants to use something else they can set the SecurityContextRepository that they want to use.

e.g. We have our own SwitchUserConfigurer and we use:

http.apply(new SwitchUserConfigurer<>())

to apply the switch user. This means that people can get the configured security context repository and set it in their own configurer.

Start with SwitchUserFilter and the custom SwitchUserConfigurer described in the issue, then compare their SecurityContextRepository defaults with the listed authentication filters. Reproduce switching users with NullSecurityContextRepository configured and verify that the default behavior no longer creates sessions while an explicitly configured repository still works.