spring-projects / spring-projects/spring-security

Adding spring-cloud-starter-eureka to classpath causes a proxied RememberMeService to fail with uninitialized fields

Open
#4,273 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Summary

I have a class called "CustomPersistentRememberMeServices" that extends AbstractRememberMeServices. When spring-cloud-starter-eureka is added to the classpath, this RememberMeService gets proxied because of some aspect point cuts that now exist. AbstractRememberMeServices has a method called "loginSuccess" that gets called by a successfulAuthentication. But the loginSuccess method is final, so it cannot be proxied by cglib. When this method is called, it references a "logger" which is in the proxy, not the proxied class and it is null in the proxy. Since cglib can't proxy the loginSuccess method, the correct underlying proxied class is never called.

Actual Behavior

A null pointer exception occurs trying to use the logger on the proxy class instead of the proxied class.

Expected Behavior

The aspect point cut that causes cglib to create the proxy needs to override the methods marked as final. So should remove the final on the loginSuccess (and also loginFail) methods.

Configuration
Version

spring_core_version=4.3.7.RELEASE
spring_boot_version=1.5.2.RELEASE
spring_security_version=4.2.2.RELEASE
spring_cloud_version=Camden.SR5

Sample

Will create a sample project and post here shortly.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with AbstractRememberMeServices and inspect successfulAuthentication, loginSuccess, and loginFail, then reproduce with spring-cloud-starter-eureka on the versions listed. Confirm the proxy path and the logger-related null pointer, and use that reproduction to verify the final-method behavior is corrected without breaking remember-me authentication.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring, spring-boot
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.