spring-projects / spring-projects/spring-security
Wrong instance of FilterSecurityInterceptor used when multiple filter chains are active
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
There seems to be something fishy going on in WebSecurityConfigurerAdapter. The symptom is that users see JSP and thymeleaf authz tags evaluating using the wrong access rules - they get handed a FilterSecurityInterceptor from only one (the last ordered) WebSecurityConfigurer. If there are multiple WebSecurityConfigurers then each of them tries to set the "postBuildAction" in the global WebSecurity instance, and it is in that action that the WebSecurity acquires its single FilterSecurityInterceptor (whereas it seems it should be accumulating rules from each of the filter chains in order).
See https://github.com/spring-projects/spring-boot/issues/9696 for a sample.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing WebSecurityConfigurerAdapter and the postBuildAction configured on the global WebSecurity instance. Inspect how each FilterSecurityInterceptor is selected when multiple WebSecurityConfigurers create separate filter chains, and compare the behavior with JSP and Thymeleaf authorization tags. Done means those tags use the access rules from the applicable filter chain; the linked Spring Boot issue provides a reproduction example.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authorization, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100