spring-projects / spring-projects/spring-security
Adding spring-cloud-starter-eureka to classpath causes a proxied RememberMeService to fail with uninitialized fields
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Summary
I have a class called "CustomPersistentRememberMeServices" that extends AbstractRememberMeServices. When spring-cloud-starter-eureka is added to the classpath, this RememberMeService gets proxied because of some aspect point cuts that now exist. AbstractRememberMeServices has a method called "loginSuccess" that gets called by a successfulAuthentication. But the loginSuccess method is final, so it cannot be proxied by cglib. When this method is called, it references a "logger" which is in the proxy, not the proxied class and it is null in the proxy. Since cglib can't proxy the loginSuccess method, the correct underlying proxied class is never called.
Actual Behavior
A null pointer exception occurs trying to use the logger on the proxy class instead of the proxied class.
Expected Behavior
The aspect point cut that causes cglib to create the proxy needs to override the methods marked as final. So should remove the final on the loginSuccess (and also loginFail) methods.
Configuration
Version
spring_core_version=4.3.7.RELEASE
spring_boot_version=1.5.2.RELEASE
spring_security_version=4.2.2.RELEASE
spring_cloud_version=Camden.SR5
Sample
Will create a sample project and post here shortly.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with AbstractRememberMeServices and inspect successfulAuthentication, loginSuccess, and loginFail, then reproduce with spring-cloud-starter-eureka on the versions listed. Confirm the proxy path and the logger-related null pointer, and use that reproduction to verify the final-method behavior is corrected without breaking remember-me authentication.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring, spring-boot
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100