spring-projects / spring-projects/spring-security
Calling SecurityContextHolder.setStrategyName(strategy) breaks Spring filters
@sjohnr is already working on this.
Since Jul 21, 2023.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Calling SecurityContextHolder.setStrategyName(strategy) with any strategy name breaks spring filters because of code like:
https://github.com/spring-projects/spring-security/blob/c4485a8909119f88559dd4200cd3506024749529/web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.java#L118C7-L118C7
Many of our filters use SecurityContextHolder.getContext() directly, which will cause them to use a different strategy instance to look up the thread local context.
This makes changing the strategy difficult in situations where SecurityContextHolder.setStrategyName(strategy) cannot be called before Spring filters are initialized; the only solution is via system properties so that it is not reset in code
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.