Documentation: OpenSessionInView problem

When you follow the guide to integrated Spring session with Spring Security, you will place the sessionRepositoryFilter at the top of the processing chain.

This places it before the OpenSessionInViewFilter which will normally be configured in the AppInitializer or web.xml. And it will create LazyLoadingExceptions if anything is saved during the authentication process, such as updating the last login date.

To solve this, a user will need to remove the OpenSessionInViewFilter from the AppInitializer/web.xml and add it to AbstractHttpSessionApplicationInitializer like so:

public class SessionWebApplicationInitializer extends AbstractHttpSessionApplicationInitializer {

public SessionWebApplicationInitializer() {
}

public SessionWebApplicationInitializer(Class<?>... configurationClasses) {
    super(configurationClasses);
}

protected void beforeSessionRepositoryFilter(ServletContext servletContext) {
    Dynamic registration = servletContext.addFilter("openSessionInViewFilter", new OpenSessionInViewFilter());
    if (registration == null) {
        throw new IllegalStateException(
                "Duplicate Filter registration for openSessionInViewFilter. Check to ensure the Filter is only configured once.");
    }
    registration.setAsyncSupported(false);
    EnumSet<DispatcherType> dispatcherTypes = getSessionDispatcherTypes();
    registration.addMappingForUrlPatterns(dispatcherTypes, false,"/*");
}

}

Start with the integrated Spring Session and Spring Security guide and locate its filter-ordering instructions. Update the guide to explain the OpenSessionInViewFilter interaction and the AppInitializer/web.xml configuration, using AbstractHttpSessionApplicationInitializer as shown. Done means the documented setup avoids LazyLoadingExceptions during authentication.