Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1788: Avoid unnecessary call to getPreAuthenticatedPrincipal() in AbstractPreAuthenticatedProcessingFilter when not checking for principal changes is not enabled.

This commit is contained in:
Luke Taylor 2011-08-04 14:33:54 +01:00
parent 7399c9a7a5
commit 0c2a950fa0
1 changed files with 20 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
web/src/main/java/org/springframework/security/web/authentication/preauth/AbstractPreAuthenticatedProcessingFilter.java
View File

@ -130,9 +130,16 @@ public abstract class AbstractPreAuthenticatedProcessingFilter extends GenericFi
return true;
}
if (!checkForPrincipalChanges) {
return false;
}
Object principal = getPreAuthenticatedPrincipal(request);
if (checkForPrincipalChanges &&
!currentUser.getName().equals(principal)) {
if (currentUser.getName().equals(principal)) {
return false;
}
logger.debug("Pre-authenticated principal has changed to " + principal + " and will be reauthenticated");
if (invalidateSessionOnPrincipalChange) {
@ -147,9 +154,6 @@ public abstract class AbstractPreAuthenticatedProcessingFilter extends GenericFi
return true;
}
return false;
}
/**
* Puts the <code>Authentication</code> instance returned by the
* authentication manager into the secure context.