spring-projects / spring-projects/spring-security

SecurityContextRepository does not save security context into JDBC session if one of authentication field was changed

Open
#18,268 1 comment 0 reactions 1 assignee View on GitHub

@rwinch is already working on this.

Since Jan 6, 2026.

status: waiting-for-triage type: bug
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Description:
When customized Authentication with some additional fields is used along with spring-session-jdbc and implicit session saving, then if one of the field of that Authentication was updated, SecurityContext is not persisted into JDBC session unless Authentication is explicitly re-set at SecurityContext.

Spring Boot ver. 3.5.8
Spring Security ver. 6.5.7
Spring Session ver. 3.5.3

Steps to Reproduce
Use attached sample.
It contains of CustomizedAuthenticationManager that performs authentication and wraps it with WrappedAuthentication. WrappedAuthentication contains extra data field.
SecurityConfig sets sessions to be implicitly saved by Spring.
IndexController contains 2 endpoints:
/index that writes out current authentication details and /extra that updates extra data field in current authetication then writes it out.

  1. Run sample, log in (user/password) and then open /index endpoint. You'll see following data:
Image
  1. Go to /extra endpoint, data has changed:
Image
  1. Open /index endpoint again. It is expected that extraAuthData is ExtraAuthData{stringA='STRING C', stringB='STRING D'}, but actual value is still ExtraAuthData{stringA='String A', stringB='String B'} -- because session was loaded, but was not saved at step 2.

Stop the sample, go to org/session/test/sample/auth/WrappedAuthentication.java and uncomment line 69:

SecurityContextHolder.getContext().setAuthentication(shallowCopy()); // this force Spring Session to save updated authentication

Repeat steps 1-3 and this time at step 3 extraAuthData is ExtraAuthData{stringA='STRING C', stringB='STRING D'} as expected.

Expected behavior
When authentication details are updated, changes are saved to JDBC session without setting Authentication object in SecurityContext.

Sample
Attached session_demo.zip

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.