spring-projects / spring-projects/spring-security
SEC-2752: Allow AnonymousAuthenticationToken to be initialized with empty authorities
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Felix Barnsteiner (Migrated from SEC-2752) said:
The AnonymousAuthenticationToken doesn't allow the list of granted authorities to be empty. In our environment, the list of allowed actions is configurable via the database. Our customer configured the anonymous user so that it doesn't have a authority.
Would it be possible for you to loosen that constraint in AnonymousAuthenticationToken #52? Previously, we (wrongly) used the PreAuthenticatedAuthenticationToken to represent the anonymous user, which does not have this constraint. The current workaround is to include a dummy authority if the list is empty.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating AnonymousAuthenticationToken and inspect the constraint that rejects an empty authority list. Confirm how the token is initialized and how authorities are validated. Done means an anonymous token can be created with no authorities while retaining the existing behavior for non-empty authorities.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100