未在安全链过滤器中设置SecurityContext

Question

In my spring project, I would like to create an endpoint which returns the security context user details for a clients active session cookie.

One way would be a specific method implementation within a controller

@RequestMapping(value = "/session", method = GET)
public AuthenticatedUserDto getCurrentSession(HttpServletResponse response) {
    if (SecurityContextHolder.getContext().getAuthentication().getPrincipal() != null && SecurityContextHolder.getContext().getAuthentication().getPrincipal() instanceof User) {
        return AuthenticatedUserBuilder.build(SecurityContextHolder.getContext().getAuthentication());
    }
    throw new BadCredentialsException("unkown session");
}

There is few things which bother me on this approach:

• I need a ugly if to determine if it's not an anonymous authentication

• I am handling this issue far to deep within the context, as I have all information already as soon the session cookie gets resolved.

So my other approach is using a security chain filter for matching the specific url ("/session), and handle the task there.

public class SessionObjectResponder extends GenericFilterBean {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        ...//do create my response
        ..
    }
}

Adding the filter just before the AnonymousAuthenticationFilter , should guarantee that I would have the security context available matching the session cookie. So I configured my web security like this:

httpSecurity.antMatcher("/session").addFilterBefore(new SessionObjectResponder(),AnonymousAuthenticationFilter.class);

Oddly, the SecurityContextHolder contains a null authentication even when a valid session cookie is passed. I also can see that within the SecurityContextPersistenceFilter no security context gets set.

When I remove the httpSecurity configuration for this filter and add the @Component to the filter class, the SecurityContext is loaded correctly again. (Without path matching of course)

Why is that?

Answer 1

You can ask for the Authentication or Principal like this:

@RequestMapping(value = "/session", method = GET)
public AuthenticatedUserDto getCurrentSession(Authentication auth) {
    if (auth == null || !auth.isAuthenticated())
        throw new BadCredentialsException("unkown session");
    return AuthenticatedUserBuilder.build(auth);
}

Answer 2

When you use @Component or @Service or @Controller ... then it becomes spring managed been. Their life cycle is managed by spring container. Therefore context is available in container created instances.

But in your case of

httpSecurity.antMatcher("/session").addFilterBefore(new SessionObjectResponder(),AnonymousAuthenticationFilter.class);

You are creating the instance with new operator. It is not created by the container. So this instance is outside the container scope. Therefore the context is not available in that instance at runtime.