Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-07-12 05:13:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-1735: Do not remove SecurityContext from HttpSession when anonymous Authentication is saved if original SecurityContext was anonymous

Browse Source
This commit is contained in:
Rob Winch 2011-07-17 22:21:32 -05:00
parent 25e17c1568
commit 3679227b11
2 changed files with 25 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java
View File

@ -93,7 +93,7 @@ public class HttpSessionSecurityContextRepository implements SecurityContextRepo
} }
requestResponseHolder.setResponse(new SaveToSessionResponseWrapper(response, request, requestResponseHolder.setResponse(new SaveToSessionResponseWrapper(response, request,
httpSession != null, context.hashCode())); httpSession != null, context));
return context; return context;
} }
@ -295,6 +295,7 @@ public class HttpSessionSecurityContextRepository implements SecurityContextRepo
private HttpServletRequest request; private HttpServletRequest request;
private boolean httpSessionExistedAtStartOfRequest; private boolean httpSessionExistedAtStartOfRequest;
private int contextHashBeforeChainExecution; private int contextHashBeforeChainExecution;
private final SecurityContext contextBeforeExecution;
/** /**
* Takes the parameters required to call <code>saveContext()</code> successfully in * Takes the parameters required to call <code>saveContext()</code> successfully in
@ -304,17 +305,17 @@ public class HttpSessionSecurityContextRepository implements SecurityContextRepo
* @param httpSessionExistedAtStartOfRequest indicates whether there was a session in place before the * @param httpSessionExistedAtStartOfRequest indicates whether there was a session in place before the
* filter chain executed. If this is true, and the session is found to be null, this indicates that it was * filter chain executed. If this is true, and the session is found to be null, this indicates that it was
* invalidated during the request and a new session will now be created. * invalidated during the request and a new session will now be created.
* @param contextHashBeforeChainExecution the hashcode of the context before the filter chain executed. * @param context the context before the filter chain executed.
* The context will only be stored if it has a different hashcode, indicating that the context changed * The context will only be stored if it or its contents changed during the request.
* during the request.
*/ */
SaveToSessionResponseWrapper(HttpServletResponse response, HttpServletRequest request, SaveToSessionResponseWrapper(HttpServletResponse response, HttpServletRequest request,
boolean httpSessionExistedAtStartOfRequest, boolean httpSessionExistedAtStartOfRequest,
int contextHashBeforeChainExecution) { SecurityContext contextBeforeExcecution) {
super(response, disableUrlRewriting); super(response, disableUrlRewriting);
this.request = request; this.request = request;
this.httpSessionExistedAtStartOfRequest = httpSessionExistedAtStartOfRequest; this.httpSessionExistedAtStartOfRequest = httpSessionExistedAtStartOfRequest;
this.contextHashBeforeChainExecution = contextHashBeforeChainExecution; this.contextHashBeforeChainExecution = contextBeforeExcecution.hashCode();
this.contextBeforeExecution = contextBeforeExcecution;
} }
/** /**
@ -338,8 +339,9 @@ public class HttpSessionSecurityContextRepository implements SecurityContextRepo
logger.debug("SecurityContext is empty or anonymous - context will not be stored in HttpSession. "); logger.debug("SecurityContext is empty or anonymous - context will not be stored in HttpSession. ");
} }
if (httpSession != null) { if (httpSession != null && !contextObject.equals(contextBeforeExecution)) {
// SEC-1587 A non-anonymous context may still be in the session // SEC-1587 A non-anonymous context may still be in the session
// SEC-1735 remove if the contextBeforeExecution was not anonymous
httpSession.removeAttribute(SPRING_SECURITY_CONTEXT_KEY); httpSession.removeAttribute(SPRING_SECURITY_CONTEXT_KEY);
} }
return; return;

16
web/src/test/java/org/springframework/security/web/context/HttpSessionSecurityContextRepositoryTests.java
View File

@ -1,6 +1,7 @@
package org.springframework.security.web.context; package org.springframework.security.web.context;
import static org.junit.Assert.*; import static org.junit.Assert.*;
import static org.springframework.security.web.context.HttpSessionSecurityContextRepository.*;
import org.junit.Test; import org.junit.Test;
import org.springframework.mock.web.MockHttpServletRequest; import org.springframework.mock.web.MockHttpServletRequest;
@ -186,6 +187,21 @@ public class HttpSessionSecurityContextRepositoryTests {
assertTrue(repo.generateNewContext() instanceof MockContext); assertTrue(repo.generateNewContext() instanceof MockContext);
} }
// SEC-1735
@Test
public void contextIsNotRemovedFromSessionIfContextBeforeExecutionDefault() throws Exception {
HttpSessionSecurityContextRepository repo = new HttpSessionSecurityContextRepository();
MockHttpServletRequest request = new MockHttpServletRequest();
HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request, new MockHttpServletResponse());
repo.loadContext(holder);
SecurityContext ctxInSession = SecurityContextHolder.createEmptyContext();
ctxInSession.setAuthentication(testToken);
request.getSession().setAttribute(SPRING_SECURITY_CONTEXT_KEY, ctxInSession);
SecurityContextHolder.getContext().setAuthentication(new AnonymousAuthenticationToken("x","x", AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS")));
repo.saveContext(SecurityContextHolder.getContext(), holder.getRequest(), holder.getResponse());
assertSame(ctxInSession,request.getSession().getAttribute(SPRING_SECURITY_CONTEXT_KEY));
}
@Test @Test
@SuppressWarnings("deprecation") @SuppressWarnings("deprecation")
public void sessionDisableUrlRewritingPreventsSessionIdBeingWrittenToUrl() throws Exception { public void sessionDisableUrlRewritingPreventsSessionIdBeingWrittenToUrl() throws Exception {