spring-projects / spring-projects/spring-security
Allow opting out of clearing security context in `OneTimeTokenAuthenticationFilter#unsuccessfulAuthentication`
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
When MFA is enabled it would be user friendly to allow few failed OTT login attempts before it clears security context.
But OneTimeTokenAuthenticationFilter#unsuccessfulAuthentication always calls securityContextHolderStrategy.clearContext().
Example:
- User successfully logs in with password.
- User attempts to authenticate with OTT, but first failed OTT attempt clears the password authority as well.
It would be nice to have it configurable without having to subclass AbstractAuthenticationProcessingFilter myself (OneTimeTokenAuthenticationFilter is final so and is hardcoded type in configurer, so it's not a good solution).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with OneTimeTokenAuthenticationFilter#unsuccessfulAuthentication and the configuration path that creates this final filter. Determine how an opt-out can be exposed without requiring a subclass. Done means failed OTT authentication can optionally preserve the existing password authority while retaining the current clearing behavior by default.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100