spring-projects / spring-projects/spring-security
SEC-3115: allow saved-request redirection for manual authentication
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Christopher Smith (Migrated from SEC-3115) said:
In certain circumstances, I would like to permit a user who's just created an account to be immediately authenticated and redirected to the protected resource that triggered an original login request. The redirect is handled by the SavedRequestAwareAuthenticationSuccessHandler for an ordinary login, but the handler instance is not accessible outside the AbstractAuthenticationProcessingFilter, and the RequestCache where it keeps the saved information is not available outside the handler.
I would like some mechanism whereby I could manually set the user's security context at the end of an account-creation operation and then perform the same redirect.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the issue's references to SavedRequestAwareAuthenticationSuccessHandler, AbstractAuthenticationProcessingFilter, and RequestCache. Trace how saved requests are retained during ordinary login and identify what an account-creation flow would need to access. Done means a documented mechanism can set the security context manually and perform the equivalent redirect.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100