spring-projects / spring-projects/spring-security
Consider how the current `Authentication` is merged with additional `Authentication` instances
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
CAUTION This is a ticket that needs to be considered by the Spring Security team and thus is not currently a candidate for a pull request.
Currently the behavior for merging Authentication is to add the authorities of the existing Authentication to the new Authentication. We should carefully consider if this should be inverted. Upon deciding, we should document the way in which it is performed and the reasoning for that.
NOTE: If gh-17987 is implemented, users could invert the behavior by returning a custom Authentication.toBuilder() implementation.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the current behavior for merging Authentication instances and the custom Authentication.toBuilder() path mentioned in the issue. Decide whether existing or new authorities should take precedence, then document the chosen behavior and its reasoning; gh-17987 is the related issue noted in the payload.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100