spring-projects / spring-projects/spring-security
SEC-2548: AuthenticationSwitchUserEvent is published before the actual Authentication object is placed in SecurityContext
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Anders Steiner (Migrated from SEC-2548) said:
The AuthenticationSwitchUserEvent is published in attemptSwitchUser method before the Authentication object is placed in the Security Context. The event should be published after line 158 where SecurityContextHolder.getContext().setAuthentication(targetUser); is called.
The issue is also there when trying to exit an user, The event is published in attemptExitUser when it should be published in the doFilter method after line 173.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the attemptSwitchUser and attemptExitUser entry points, then trace the related doFilter flow and the referenced SecurityContextHolder updates. Verify that AuthenticationSwitchUserEvent is published only after the target Authentication is placed in the SecurityContext for both switching and exiting, and confirm the event observes the updated context.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100