spring-projects / spring-projects/spring-security
SEC-2168: Provide classloader customization when using SecurityContextHolder.setStrategyName
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Ludovic Praud (Migrated from SEC-2168) said:
I am using playframework and the class java.lang.Class classloader is not the same as the application one in dev mode due to hot reload by classloader (in prod mode it is ok).
So when providing a SecurityContextHolderStrategy class it is not found when using Class.forName(String).
It would be handy to provide a different class loader, when setting the strategy with something like : SecurityContextHolder.setStrategyName(String, ClassLoader)
A workaround is to directly set an instance of SecurityContextHolderStrategy to the SecurityContextHolder strategy field using the reflection hack of java.lang.reflect.Field.setAccessible(true)
Somehow related issues #SEC-889, #SEC-1622, #SEC-304
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with SecurityContextHolder.setStrategyName(String) and the strategy-loading path that currently uses Class.forName(String). Check how the class loader is selected, then consider the issue complete when callers can supply a ClassLoader to load a custom SecurityContextHolderStrategy without using the reflection workaround.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100