Implementing UserDetails and CredentialsContainer in Spring Security

Question

I want to erase the user's credentials after login, so i'm implementing UserDetails and CredentialsContainer in my Account class.

@Entity
public class Account implements UserDetails, CredentialsContainer {
...

However, in the docs it says that CredentialsContainer is For internal framework use only .

So I was wondering if this can be a problem in the future.

Answer 1

You can implement the interface. However, it isn't intended to be implemented if you are writing your own AuthenticationProvider. From the javadoc:

For internal framework use only. Users who are writing their own AuthenticationProvider implementations should create and return an appropriate Authentication object there, minus any sensitive data, rather than using this interface.

So you can implement it so that Spring Security will call eraseCredentials on your app. However, it is not recommended for you to invoke eraseCredentials on the CredentialsContainer .