Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-07-02 16:52:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-112: Bug when SecurityEnforcementFilter used with disabled Authentication and remember-me services.

Browse Source
This commit is contained in:
Ben Alex 2005-11-25 04:38:18 +00:00
parent 47166fe078
commit 9ccaf05cc7
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
core/src/main/java/org/acegisecurity/intercept/web/SecurityEnforcementFilter.java
View File

@ -278,6 +278,10 @@ public class SecurityEnforcementFilter implements Filter, InitializingBean {
((HttpServletRequest) request).getSession().setAttribute(AbstractProcessingFilter.ACEGI_SECURITY_TARGET_URL_KEY,
targetUrl);
}
// SEC-112: Clear the SecurityContextHolder's Authentication, as the
// existing Authentication is no longer considered valid
SecurityContextHolder.getContext().setAuthentication(null);
authenticationEntryPoint.commence(request,
(HttpServletResponse) fi.getResponse(), reason);