ContextHolder with the Authentication
+ * Populates SecurityContext with the Authentication
* obtained from the container's
* HttpServletRequest.getUserPrincipal().
*
@@ -46,11 +45,12 @@ import javax.servlet.http.HttpServletRequest;
*
*
* This filter never preserves the Authentication on the
- * ContextHolder - it is replaced every request.
+ * SecurityContext - it is replaced every request.
*
- * See {@link net.sf.acegisecurity.context.HttpSessionContextIntegrationFilter} for further information. + * See {@link net.sf.acegisecurity.context.HttpSessionContextIntegrationFilter} + * for further information. *
* * @author Ben Alex @@ -70,18 +70,16 @@ public class HttpRequestIntegrationFilter implements Filter { public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { - SecureContext sc = SecureContextUtils.getSecureContext(); - if (request instanceof HttpServletRequest) { Principal principal = ((HttpServletRequest) request) .getUserPrincipal(); if ((principal != null) && principal instanceof Authentication) { - sc.setAuthentication((Authentication) principal); + SecurityContext.setAuthentication((Authentication) principal); if (logger.isDebugEnabled()) { logger.debug( - "ContextHolder updated with Authentication from container: '" + "SecurityContext updated with Authentication from container: '" + principal + "'"); } } else { diff --git a/core/src/main/java/org/acegisecurity/context/Context.java b/core/src/main/java/org/acegisecurity/context/Context.java deleted file mode 100644 index 941c14fa6f..0000000000 --- a/core/src/main/java/org/acegisecurity/context/Context.java +++ /dev/null @@ -1,46 +0,0 @@ -/* Copyright 2004 Acegi Technology Pty Limited - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package net.sf.acegisecurity.context; - -import java.io.Serializable; - - -/** - * Holds objects that are needed on every request. - * - *
- * A Context will be sent between application tiers via a {@link
- * ContextHolder}.
- *
Context is properly configured.
- *
- * - * This allows implementations to confirm they are valid, as this method is - * automatically called by the {@link ContextInterceptor}. - *
- * - * @throws ContextInvalidException if theContext is invalid.
- */
- public void validate() throws ContextInvalidException;
-}
diff --git a/core/src/main/java/org/acegisecurity/context/ContextException.java b/core/src/main/java/org/acegisecurity/context/ContextException.java
deleted file mode 100644
index fb26e5c32b..0000000000
--- a/core/src/main/java/org/acegisecurity/context/ContextException.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/* Copyright 2004 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.sf.acegisecurity.context;
-
-import org.springframework.core.NestedRuntimeException;
-
-
-/**
- * Abstract superclass for all exceptions thrown in the context package and
- * subpackages.
- *
- * - * Note that this is a runtime (unchecked) exception. - *
- * - * @author Ben Alex - * @version $Id$ - */ -public abstract class ContextException extends NestedRuntimeException { - //~ Constructors =========================================================== - - /** - * Constructs aContextException with the specified message
- * and root cause.
- *
- * @param msg the detail message
- * @param t the root cause
- */
- public ContextException(String msg, Throwable t) {
- super(msg, t);
- }
-
- /**
- * Constructs a ContextException with the specified message
- * and no root cause.
- *
- * @param msg the detail message
- */
- public ContextException(String msg) {
- super(msg);
- }
-}
diff --git a/core/src/main/java/org/acegisecurity/context/ContextHolderEmptyException.java b/core/src/main/java/org/acegisecurity/context/ContextHolderEmptyException.java
deleted file mode 100644
index e4ec30fea6..0000000000
--- a/core/src/main/java/org/acegisecurity/context/ContextHolderEmptyException.java
+++ /dev/null
@@ -1,48 +0,0 @@
-/* Copyright 2004 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.sf.acegisecurity.context;
-
-/**
- * Thrown if a {@link ContextHolder} object does not contain a valid {@link
- * Context}.
- *
- * @author Ben Alex
- * @version $Id$
- */
-public class ContextHolderEmptyException extends ContextException {
- //~ Constructors ===========================================================
-
- /**
- * Constructs a ContextHolderEmptyException with the specified
- * message.
- *
- * @param msg the detail message
- */
- public ContextHolderEmptyException(String msg) {
- super(msg);
- }
-
- /**
- * Constructs a ContextHolderEmptyException with the specified
- * message and root cause.
- *
- * @param msg the detail message
- * @param t root cause
- */
- public ContextHolderEmptyException(String msg, Throwable t) {
- super(msg, t);
- }
-}
diff --git a/core/src/main/java/org/acegisecurity/context/ContextImpl.java b/core/src/main/java/org/acegisecurity/context/ContextImpl.java
deleted file mode 100644
index 00161ba4c7..0000000000
--- a/core/src/main/java/org/acegisecurity/context/ContextImpl.java
+++ /dev/null
@@ -1,30 +0,0 @@
-/* Copyright 2004 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.sf.acegisecurity.context;
-
-/**
- * Basic concrete implementation of a {@link Context}.
- *
- * @author Ben Alex
- * @version $Id$
- */
-public class ContextImpl implements Context {
- //~ Methods ================================================================
-
- public void validate() throws ContextInvalidException {
- // Nothing to validate.
- }
-}
diff --git a/core/src/main/java/org/acegisecurity/context/ContextInterceptor.java b/core/src/main/java/org/acegisecurity/context/ContextInterceptor.java
deleted file mode 100644
index d673fc31e1..0000000000
--- a/core/src/main/java/org/acegisecurity/context/ContextInterceptor.java
+++ /dev/null
@@ -1,58 +0,0 @@
-/* Copyright 2004 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.sf.acegisecurity.context;
-
-import org.aopalliance.intercept.MethodInterceptor;
-import org.aopalliance.intercept.MethodInvocation;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-
-/**
- * Ensures the {@link ContextHolder} contains a valid {@link Context}.
- *
- *
- * This interceptor works by calling {@link Context#validate()} before
- * proceeding with method invocations. It is configured in the bean context
- * with a ProxyFactoryBean.
- *
ContextInvalidException with the specified
- * message.
- *
- * @param msg the detail message.
- */
- public ContextInvalidException(String msg) {
- super(msg);
- }
-
- /**
- * Constructs a ContextInvalidException with the specified
- * message and root cause.
- *
- * @param msg the detail message.
- * @param t root cause
- */
- public ContextInvalidException(String msg, Throwable t) {
- super(msg, t);
- }
-}
diff --git a/core/src/main/java/org/acegisecurity/context/HttpSessionContextIntegrationFilter.java b/core/src/main/java/org/acegisecurity/context/HttpSessionContextIntegrationFilter.java
index f5bd4c14d2..943f33f490 100644
--- a/core/src/main/java/org/acegisecurity/context/HttpSessionContextIntegrationFilter.java
+++ b/core/src/main/java/org/acegisecurity/context/HttpSessionContextIntegrationFilter.java
@@ -15,11 +15,11 @@
package net.sf.acegisecurity.context;
+import net.sf.acegisecurity.Authentication;
+
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
-import org.springframework.beans.factory.InitializingBean;
-
import java.io.IOException;
import javax.servlet.Filter;
@@ -34,23 +34,17 @@ import javax.servlet.http.HttpSession;
/**
*
- * Populates the ContextHolder with information obtained from the
- * HttpSession.
+ * Populates the SecurityContext with information obtained from
+ * the HttpSession.
*
* The HttpSession will be queried to retrieve the
- * Context that should be stored against the
- * ContextHolder for the duration of the web request. At the end
- * of the web request, any updates made to the ContextHolder will
- * be persisted back to the HttpSession by this filter.
- *
- * If a valid Context cannot be obtained from the
- * HttpSession for whatever reason, a fresh Context
- * will be created and used instead. The created object will be of the
- * instance defined by the {@link #setContext(Class)} method.
+ * Authentication that should be stored against the
+ * SecurityContext for the duration of the web request. At the
+ * end of the web request, any updates made to the
+ * SecurityContext will be persisted back to the
+ * HttpSession by this filter.
*
@@ -58,11 +52,9 @@ import javax.servlet.http.HttpSession;
* already exist. If at the end of the web request the
* HttpSession does not exist, a HttpSession will
* only be created if the current contents of
- * ContextHolder are not {@link
- * java.lang.Object#equals(java.lang.Object)} to a new instance
- * of {@link #setContext(Class)}. This avoids needless
- * HttpSession creation, but automates the storage of changes
- * made to the ContextHolder.
+ * SecurityContext are not null. This avoids
+ * needless HttpSession creation, but automates the storage of
+ * changes made to the SecurityContext.
*
@@ -76,35 +68,30 @@ import javax.servlet.http.HttpSession;
* similar clients that will never present the same jsessionid
* etc), the {@link #setAllowSessionCreation(boolean)} should be set to
* false. Only do this if you really need to conserve server
- * memory and ensure all classes using the ContextHolder are
- * designed to have no persistence of the Context between web
- * requests.
+ * memory and ensure all classes using the SecurityContext are
+ * designed to have no persistence of the Authentication between
+ * web requests.
*
- * This filter MUST be executed BEFORE any authentication procesing mechanisms.
- * Authentication processing mechanisms (eg BASIC, CAS processing filters etc)
- * expect the ContextHolder to contain a valid
- * SecureContext by the time they execute.
+ * This filter MUST appear BEFORE any other Acegi Security related filters,
+ * because this filter WILL REMOVE any Authentication it finds in
+ * the SecurityContext.
*
HttpSession if needed
* (sessions are always created sparingly, but setting this value to false
@@ -122,24 +109,6 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean,
return allowSessionCreation;
}
- public void setContext(Class secureContext) {
- this.context = secureContext;
- }
-
- public Class getContext() {
- return context;
- }
-
- public void afterPropertiesSet() throws Exception {
- if ((this.context == null)
- || (!Context.class.isAssignableFrom(this.context))) {
- throw new IllegalArgumentException(
- "context must be defined and implement Context (typically use net.sf.acegisecurity.context.security.SecureContextImpl)");
- }
-
- this.contextObject = generateNewContext();
- }
-
/**
* Does nothing. We use IoC container lifecycle services instead.
*/
@@ -155,14 +124,16 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean,
request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
}
- if (ContextHolder.getContext() != null) {
+ // Nullify the ThreadLocal if it currently contains data (it shouldn't)
+ if (SecurityContext.getAuthentication() != null) {
if (logger.isWarnEnabled()) {
logger.warn(
- "ContextHolder should have been null but contained: '"
- + ContextHolder.getContext() + "'; setting to null now");
+ "SecurityContext should have been null but contained: '"
+ + SecurityContext.getAuthentication()
+ + "'; setting to null now");
}
- ContextHolder.setContext(null);
+ SecurityContext.setAuthentication(null);
}
HttpSession httpSession = null;
@@ -175,29 +146,30 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean,
if (httpSession != null) {
httpSessionExistedAtStartOfRequest = true;
- Object contextObject = httpSession.getAttribute(ACEGI_SECURITY_CONTEXT_KEY);
+ Object authenticationObject = httpSession.getAttribute(ACEGI_SECURITY_AUTHENTICATION_CONTEXT_KEY);
- if (contextObject != null) {
- if (contextObject instanceof Context) {
+ if (authenticationObject != null) {
+ // HttpSession provided an Authentication object
+ if (authenticationObject instanceof Authentication) {
if (logger.isDebugEnabled()) {
logger.debug(
- "Obtained from ACEGI_SECURITY_CONTEXT a valid Context and set to ContextHolder: '"
- + contextObject + "'");
+ "Obtained from ACEGI_SECURITY_AUTHENTICATION_CONTEXT a valid Authentication and set to SecurityContext: '"
+ + authenticationObject + "'");
}
- ContextHolder.setContext((Context) contextObject);
+ SecurityContext.setAuthentication((Authentication) authenticationObject);
} else {
if (logger.isWarnEnabled()) {
logger.warn(
- "ACEGI_SECURITY_CONTEXT did not contain a Context but contained: '"
- + contextObject
- + "'; are you improperly modifying the HttpSession directly (you should always use ContextHolder) or using the HttpSession attribute reserved for this class?");
+ "ACEGI_SECURITY_AUTHENTICATION_CONTEXT did not contain an Authentication but contained: '"
+ + authenticationObject
+ + "'; are you improperly modifying the HttpSession directly (you should always use SecurityContext) or using the HttpSession attribute reserved for this class?");
}
}
} else {
if (logger.isDebugEnabled()) {
logger.debug(
- "HttpSession returned null object for ACEGI_SECURITY_CONTEXT");
+ "HttpSession returned null object for ACEGI_SECURITY_AUTHENTICATION_CONTEXT");
}
}
} else {
@@ -206,25 +178,15 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean,
}
}
- if (ContextHolder.getContext() == null) {
- ContextHolder.setContext(generateNewContext());
-
- if (logger.isDebugEnabled()) {
- logger.debug(
- "As ContextHolder null, setup ContextHolder with a fresh new instance: '"
- + ContextHolder.getContext() + "'");
- }
- }
-
- // Make the HttpSession null, as we want to ensure we don't keep
- // a reference to the HttpSession laying around in case the
- // chain.doFilter() invalidates it.
+ // Make the HttpSession null, as we want to ensure we don't keep any
+ // reference to the HttpSession laying around in memory (in case the
+ // chain.doFilter() we're about to invoke decides to invalidate it).
httpSession = null;
// Proceed with chain
chain.doFilter(request, response);
- // Store context back to HttpSession
+ // Store Authentication back to HttpSession
try {
httpSession = ((HttpServletRequest) request).getSession(false);
} catch (IllegalStateException ignored) {}
@@ -232,21 +194,21 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean,
if ((httpSession == null) && httpSessionExistedAtStartOfRequest) {
if (logger.isDebugEnabled()) {
logger.debug(
- "HttpSession is now null, but was not null at start of request; session was invalidated, so do not create a new session");
+ "HttpSession is now null, but was not null at start of request; session was invalidated during filter chain, so we will NOT create a new session now");
}
}
- // Generate a HttpSession only if we need to
+ // Generate a HttpSession *only* if we have to
if ((httpSession == null) && !httpSessionExistedAtStartOfRequest) {
if (!allowSessionCreation) {
if (logger.isDebugEnabled()) {
logger.debug(
- "Whilst ContextHolder contents have changed, the HttpSessionContextIntegrationFilter is prohibited from creating a HttpSession by the allowSessionCreation property being false");
+ "The HttpSessionContextIntegrationFilter is prohibited from creating a HttpSession by the allowSessionCreation property being false");
}
- } else if (!contextObject.equals(ContextHolder.getContext())) {
+ } else if (SecurityContext.getAuthentication() != null) {
if (logger.isDebugEnabled()) {
logger.debug(
- "HttpSession being created as ContextHolder contents are non-default");
+ "HttpSession being created as SecurityContext contents are non-null");
}
try {
@@ -255,44 +217,32 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean,
} else {
if (logger.isDebugEnabled()) {
logger.debug(
- "HttpSession still null, but ContextHolder has not changed from default: ' "
- + ContextHolder.getContext()
- + "'; not creating HttpSession or storing ContextHolder contents");
+ "SecurityContext contents and HttpSession are both null; not creating HttpSession");
}
}
}
- // If HttpSession exists, store current ContextHolder contents
+ // If HttpSession exists or was just created, store current SecurityContext contents
if (httpSession != null) {
- httpSession.setAttribute(ACEGI_SECURITY_CONTEXT_KEY,
- ContextHolder.getContext());
+ httpSession.setAttribute(ACEGI_SECURITY_AUTHENTICATION_CONTEXT_KEY,
+ SecurityContext.getAuthentication());
if (logger.isDebugEnabled()) {
- logger.debug("Context stored to HttpSession: '"
- + ContextHolder.getContext() + "'");
+ logger.debug("SecurityContext stored to HttpSession: '"
+ + SecurityContext.getAuthentication() + "'");
}
}
- // Remove ContextHolder contents
- ContextHolder.setContext(null);
+ // Remove SecurityContext contents, ready for next request
+ SecurityContext.setAuthentication(null);
if (logger.isDebugEnabled()) {
logger.debug(
- "ContextHolder set to null as request processing completed");
+ "SecurityContext set to null as request processing completed");
}
}
}
- public Context generateNewContext() throws ServletException {
- try {
- return (Context) this.context.newInstance();
- } catch (InstantiationException ie) {
- throw new ServletException(ie);
- } catch (IllegalAccessException iae) {
- throw new ServletException(iae);
- }
- }
-
/**
* Does nothing. We use IoC container lifecycle services instead.
*
diff --git a/core/src/main/java/org/acegisecurity/context/ContextHolder.java b/core/src/main/java/org/acegisecurity/context/SecurityContext.java
similarity index 55%
rename from core/src/main/java/org/acegisecurity/context/ContextHolder.java
rename to core/src/main/java/org/acegisecurity/context/SecurityContext.java
index e50045fa2c..65e7eff43a 100644
--- a/core/src/main/java/org/acegisecurity/context/ContextHolder.java
+++ b/core/src/main/java/org/acegisecurity/context/SecurityContext.java
@@ -1,4 +1,4 @@
-/* Copyright 2004 Acegi Technology Pty Limited
+/* Copyright 2004, 2005 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -15,24 +15,30 @@
package net.sf.acegisecurity.context;
+import net.sf.acegisecurity.Authentication;
+
+
/**
- * Associates a given {@link Context} with the current execution thread.
+ * Associates a given {@link Authentication} with the current execution thread,
+ * along with new threads the current execution thread may spawn.
*
* @author Ben Alex
* @version $Id$
+ *
+ * @see java.lang.InheritableThreadLocal
*/
-public class ContextHolder {
+public class SecurityContext {
//~ Static fields/initializers =============================================
- private static ThreadLocal contextHolder = new ThreadLocal();
+ private static InheritableThreadLocal authenticationHolder = new InheritableThreadLocal();
//~ Methods ================================================================
- public static void setContext(Context context) {
- contextHolder.set(context);
+ public static void setAuthentication(Authentication authentication) {
+ authenticationHolder.set(authentication);
}
- public static Context getContext() {
- return (Context) contextHolder.get();
+ public static Authentication getAuthentication() {
+ return (Authentication) authenticationHolder.get();
}
}
diff --git a/core/src/main/java/org/acegisecurity/context/httpinvoker/AuthenticationSimpleHttpInvokerRequestExecutor.java b/core/src/main/java/org/acegisecurity/context/httpinvoker/AuthenticationSimpleHttpInvokerRequestExecutor.java
index 5ed8d7ad7e..5bd04f3377 100644
--- a/core/src/main/java/org/acegisecurity/context/httpinvoker/AuthenticationSimpleHttpInvokerRequestExecutor.java
+++ b/core/src/main/java/org/acegisecurity/context/httpinvoker/AuthenticationSimpleHttpInvokerRequestExecutor.java
@@ -17,8 +17,7 @@ package net.sf.acegisecurity.context.httpinvoker;
import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.AuthenticationCredentialsNotFoundException;
-import net.sf.acegisecurity.context.ContextHolder;
-import net.sf.acegisecurity.context.security.SecureContext;
+import net.sf.acegisecurity.context.SecurityContext;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.logging.Log;
@@ -87,38 +86,25 @@ public class AuthenticationSimpleHttpInvokerRequestExecutor
throws IOException, AuthenticationCredentialsNotFoundException {
super.prepareConnection(con, contentLength);
- if ((ContextHolder.getContext() != null)
- && (ContextHolder.getContext() instanceof SecureContext)) {
- Authentication auth = ((SecureContext) ContextHolder.getContext())
- .getAuthentication();
+ Authentication auth = SecurityContext.getAuthentication();
- if ((auth != null) && (auth.getPrincipal() != null)
- && (auth.getCredentials() != null)) {
- String base64 = auth.getPrincipal().toString() + ":"
- + auth.getCredentials().toString();
- con.setRequestProperty("Authorization",
- "Basic "
- + new String(Base64.encodeBase64(base64.getBytes())));
+ if ((auth != null) && (auth.getPrincipal() != null)
+ && (auth.getCredentials() != null)) {
+ String base64 = auth.getPrincipal().toString() + ":"
+ + auth.getCredentials().toString();
+ con.setRequestProperty("Authorization",
+ "Basic " + new String(Base64.encodeBase64(base64.getBytes())));
- if (logger.isDebugEnabled()) {
- logger.debug(
- "HttpInvocation now presenting via BASIC authentication ContextHolder-derived: "
- + auth.toString());
- }
- } else {
- if (logger.isDebugEnabled()) {
- logger.debug(
- "Unable to set BASIC authentication header as ContextHolder: "
- + ContextHolder.getContext()
- + "; did not provide valid Authentication: " + auth);
- }
+ if (logger.isDebugEnabled()) {
+ logger.debug(
+ "HttpInvocation now presenting via BASIC authentication ContextHolder-derived: "
+ + auth.toString());
}
} else {
if (logger.isDebugEnabled()) {
logger.debug(
- "Unable to set BASIC authentication header as ContextHolder: "
- + ContextHolder.getContext()
- + "; does not provide a SecureContext");
+ "Unable to set BASIC authentication header as SecurityContext did not provide valid Authentication: "
+ + auth);
}
}
diff --git a/core/src/main/java/org/acegisecurity/context/package.html b/core/src/main/java/org/acegisecurity/context/package.html
index bbf26cca8c..8d37261f9a 100644
--- a/core/src/main/java/org/acegisecurity/context/package.html
+++ b/core/src/main/java/org/acegisecurity/context/package.html
@@ -4,7 +4,11 @@ Provides a "request context".
A request context is associated with the current execution thread. It holds objects that would otherwise need to be included in many method signatures, -such as for authentication. +such as for authentication.
+ +The majority of this package has been deprecated. Please use the
+SecurityContext and HttpSessionContextIntegrationFilter
+classes only.