spring-projects / spring-projects/spring-security
Remove SecurityContextPersistenceFilter in Favor of Explicit Saves
Open
@rwinch is already working on this.
Since Jun 14, 2022.
in: web
type: breaks-passivity
type: enhancement
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
We should remove SecurityContextPersistenceFilter in favor of explicit saves to the SecurityContextRepository. This will provide lots of benefits:
- There will be no confusion when the SecurityContext should be saved
- Different types of authentication can save (or not save) the SecurityContext differently
- This would align with how WebFlux works
We would add a new Filter that only reads the SecurityContext and sets it on SecurityContextHolder. We should also consider providing a simplified API that doesn't involve needing to update the HttpRequestResponseHolder.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.