spring-projects / spring-projects/spring-security
Make Authentication/SecurityContext Immutable
Open
@rwinch is already working on this.
Since Jun 14, 2022.
in: core
type: enhancement
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Summary
NOTE: This was originally brought up as a question in gh-8322 this ticket is to resolve that question
Ideally we would provide Authentication implementations that are immutable to avoid race conditions. However, for historical reasons it is unfortunate that both Authentication and SecurityContext are mutable.
We should look into how we can make both of these immutable. What follows is a proposed set of tasks.
- #16668
- (breaking) Remove calls to
setAuthenticatedfrom implementations - Add
SecurityContext#withAuthentication(Authentication) - Deprecate
SecurityContext#setAuthentication
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.