From 6455e987456a806b2fe84dcc747e824ed971631f Mon Sep 17 00:00:00 2001
From: Marcus Da Coregio <marcusdacoregio@gmail.com>
Date: Tue, 12 Jul 2022 09:04:39 -0300
Subject: [PATCH] FilterSecurityInterceptor applies to every request by default

Closes gh-11466
---
 .../security/config/spring-security-6.0.rnc          |  2 +-
 .../security/config/spring-security-6.0.xsd          |  4 ++--
 .../security/config/http/MiscHttpConfigTests.java    |  4 ++--
 ...ConfigTests-WithSecurityContextHolderStrategy.xml |  7 ++++++-
 .../ROOT/pages/servlet/appendix/namespace/http.adoc  |  2 +-
 .../access/intercept/FilterSecurityInterceptor.java  |  2 +-
 .../intercept/FilterSecurityInterceptorTests.java    | 12 ++++++++++++
 7 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc
index 8b70128c5f..8ba76147ea 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc
@@ -375,7 +375,7 @@ http.attlist &=
 	## Allows a customized AuthenticationEntryPoint to be set on the ExceptionTranslationFilter.
 	attribute entry-point-ref {xsd:token}?
 http.attlist &=
-	## Corresponds to the observeOncePerRequest property of FilterSecurityInterceptor. Defaults to "true"
+	## Corresponds to the observeOncePerRequest property of FilterSecurityInterceptor. Defaults to "false"
 	attribute once-per-request {xsd:boolean}?
 http.attlist &=
 	## Prevents the jsessionid parameter from being added to rendered URLs. Defaults to "true" (rewriting is disabled).
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd
index b8211479bc..cb2adffba3 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd
@@ -1335,7 +1335,7 @@
       <xs:attribute name="once-per-request" type="xs:boolean">
          <xs:annotation>
             <xs:documentation>Corresponds to the observeOncePerRequest property of FilterSecurityInterceptor. Defaults
-                to "true"
+                to "false"
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
@@ -3729,4 +3729,4 @@
          <xs:enumeration value="LAST"/>
       </xs:restriction>
   </xs:simpleType>
-</xs:schema>
\ No newline at end of file
+</xs:schema>
diff --git a/config/src/test/java/org/springframework/security/config/http/MiscHttpConfigTests.java b/config/src/test/java/org/springframework/security/config/http/MiscHttpConfigTests.java
index f2254a90f3..9e7dacc051 100644
--- a/config/src/test/java/org/springframework/security/config/http/MiscHttpConfigTests.java
+++ b/config/src/test/java/org/springframework/security/config/http/MiscHttpConfigTests.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2018 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -853,7 +853,7 @@ public class MiscHttpConfigTests {
 		assertThat(filters.next()).isInstanceOf(SessionManagementFilter.class);
 		assertThat(filters.next()).isInstanceOf(ExceptionTranslationFilter.class);
 		assertThat(filters.next()).isInstanceOf(FilterSecurityInterceptor.class)
-				.hasFieldOrPropertyWithValue("observeOncePerRequest", true);
+				.hasFieldOrPropertyWithValue("observeOncePerRequest", false);
 	}
 
 	private <T extends Filter> T getFilter(Class<T> filterClass) {
diff --git a/config/src/test/resources/org/springframework/security/config/http/MiscHttpConfigTests-WithSecurityContextHolderStrategy.xml b/config/src/test/resources/org/springframework/security/config/http/MiscHttpConfigTests-WithSecurityContextHolderStrategy.xml
index b89d3b380b..ccbedeb90b 100644
--- a/config/src/test/resources/org/springframework/security/config/http/MiscHttpConfigTests-WithSecurityContextHolderStrategy.xml
+++ b/config/src/test/resources/org/springframework/security/config/http/MiscHttpConfigTests-WithSecurityContextHolderStrategy.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
-  ~ Copyright 2002-2018 the original author or authors.
+  ~ Copyright 2002-2022 the original author or authors.
   ~
   ~ Licensed under the Apache License, Version 2.0 (the "License");
   ~ you may not use this file except in compliance with the License.
@@ -28,6 +28,7 @@
 			https://www.springframework.org/schema/mvc/spring-mvc.xsd">
 
 	<http auto-config="true" security-context-holder-strategy-ref="ref">
+		<intercept-url request-matcher-ref="dispatcherTypeMatcher" access="permitAll" />
 		<intercept-url pattern="/**" access="authenticated"/>
 	</http>
 
@@ -37,6 +38,10 @@
 		</b:constructor-arg>
 	</b:bean>
 
+	<b:bean id="dispatcherTypeMatcher" class="org.springframework.security.web.util.matcher.DispatcherTypeRequestMatcher">
+		<b:constructor-arg value="ASYNC"/>
+	</b:bean>
+
 	<mvc:annotation-driven>
 		<mvc:argument-resolvers>
 			<b:bean class="org.springframework.security.web.method.annotation.AuthenticationPrincipalArgumentResolver">
diff --git a/docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc b/docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc
index 3b11c9872c..0a50f43257 100644
--- a/docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc
+++ b/docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc
@@ -94,7 +94,7 @@ A bean identifier, used for referring to the bean elsewhere in the context.
 [[nsa-http-once-per-request]]
 * **once-per-request**
 Corresponds to the `observeOncePerRequest` property of `FilterSecurityInterceptor`.
-Defaults to `true`.
+Defaults to `false`.
 
 
 [[nsa-http-pattern]]
diff --git a/web/src/main/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptor.java b/web/src/main/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptor.java
index 80148744a2..0c779814ae 100644
--- a/web/src/main/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptor.java
+++ b/web/src/main/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptor.java
@@ -48,7 +48,7 @@ public class FilterSecurityInterceptor extends AbstractSecurityInterceptor imple
 
 	private FilterInvocationSecurityMetadataSource securityMetadataSource;
 
-	private boolean observeOncePerRequest = true;
+	private boolean observeOncePerRequest = false;
 
 	/**
 	 * Not used (we rely on IoC container lifecycle services instead)
diff --git a/web/src/test/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptorTests.java b/web/src/test/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptorTests.java
index 2d1d0951dc..16d458b68e 100644
--- a/web/src/test/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptorTests.java
+++ b/web/src/test/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptorTests.java
@@ -50,6 +50,7 @@ import static org.mockito.BDDMockito.given;
 import static org.mockito.BDDMockito.willThrow;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyZeroInteractions;
 
@@ -174,6 +175,17 @@ public class FilterSecurityInterceptorTests {
 		assertThat(request.getAttributeNames().hasMoreElements()).isFalse();
 	}
 
+	@Test
+	public void doFilterWhenObserveOncePerRequestFalseAndInvokedTwiceThenObserveTwice() throws Throwable {
+		Authentication token = new TestingAuthenticationToken("Test", "Password", "NOT_USED");
+		SecurityContextHolder.getContext().setAuthentication(token);
+		FilterInvocation fi = createinvocation();
+		given(this.ods.getAttributes(fi)).willReturn(SecurityConfig.createList("MOCK_OK"));
+		this.interceptor.invoke(fi);
+		this.interceptor.invoke(fi);
+		verify(this.adm, times(2)).decide(any(), any(), any());
+	}
+
 	private FilterInvocation createinvocation() {
 		MockHttpServletResponse response = new MockHttpServletResponse();
 		MockHttpServletRequest request = new MockHttpServletRequest();