spring-projects / spring-projects/spring-security
SEC-2723: Add meta-data to bean definitions of Spring Security Filter beans identifying them as "inner"
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Dave Syer (Migrated from SEC-2723) said:
Add meta-data to bean definitions of Spring Security Filter beans identifying them as "inner", meaning that they have the Filter interface, but are not registered with the ServletContext (in retrospect maybe a different interface would have been better, but it's too late for that). The Filter beans created by Spring Security (with the exception of the global "springSecurityFilterChain"), and the ones added as custom filters, often trip up users of Spring Boot. If Spring Security could help us identify those beans it would make it easier to exclude them from the ServletContext.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how Spring Security Filter beans and custom filters are added to bean definitions and how they relate to the ServletContext. Check the special global springSecurityFilterChain case and the Spring Boot interaction. Done means applicable filter beans are identifiable as inner while the global chain remains excluded.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100