Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-539: Refactored so that SecurityContextHolder.setContext() is called in exactly one place. Moved setting of httpSession = null to point immediately after its last use.

This commit is contained in:
Luke Taylor 2007-08-28 22:38:55 +00:00
parent 3dd0716611
commit d1be9f9980
1 changed files with 18 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
core/src/main/java/org/acegisecurity/context/HttpSessionContextIntegrationFilter.java
View File

@ -209,34 +209,34 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean, Fi
boolean httpSessionExistedAtStartOfRequest = httpSession != null; boolean httpSessionExistedAtStartOfRequest = httpSession != null;
SecurityContext contextFromSession = extractSecurityContextFromSession(httpSession); SecurityContext contextBeforeChainExecution = extractSecurityContextFromSession(httpSession);
// This is the only block in this class in which SecurityContextHolder.setContext() is called // Make the HttpSession null, as we don't want to keep a reference to it lying
if (contextFromSession != null) { // around in case chain.doFilter() invalidates it.
SecurityContextHolder.setContext(contextFromSession); httpSession = null;
if (logger.isDebugEnabled()) { if (contextBeforeChainExecution == null) {
logger.debug("Obtained a valid SecurityContext from ACEGI_SECURITY_CONTEXT and " contextBeforeChainExecution = generateNewContext();
+ "set to SecurityContextHolder: '" + contextFromSession + "'");
}
} else {
SecurityContextHolder.setContext(generateNewContext());
if (logger.isDebugEnabled()) { if (logger.isDebugEnabled()) {
logger.debug("New SecurityContext instance associated with SecurityContextHolder"); logger.debug("New SecurityContext instance associated with SecurityContextHolder");
} }
} else {
if (logger.isDebugEnabled()) {
logger.debug("Obtained a valid SecurityContext from ACEGI_SECURITY_CONTEXT and "
+ "set to SecurityContextHolder: '" + contextBeforeChainExecution + "'");
}
} }
// Make the HttpSession null, as we want to ensure we don't keep int contextHashBeforeChainExecution = contextBeforeChainExecution.hashCode();
// a reference to the HttpSession laying around in case the
// chain.doFilter() invalidates it.
httpSession = null;
// Proceed with chain // This is the only place in this class where SecurityContextHolder.setContext() is called
int contextHashWhenChainProceeded = SecurityContextHolder.getContext().hashCode(); SecurityContextHolder.setContext(contextBeforeChainExecution);
request.setAttribute(FILTER_APPLIED, Boolean.TRUE); request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
// Proceed with chain
try { try {
chain.doFilter(request, response); chain.doFilter(request, response);
} catch (IOException ioe) { } catch (IOException ioe) {
@ -245,6 +245,7 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean, Fi
throw se; throw se;
} }
finally { finally {
// This is the only place in this class where SecurityContextHolder.getContext() is called
SecurityContext contextAfterChainExecution = SecurityContextHolder.getContext(); SecurityContext contextAfterChainExecution = SecurityContextHolder.getContext();
// Crucial removal of SecurityContextHolder contents - do this before anything else. // Crucial removal of SecurityContextHolder contents - do this before anything else.
@ -253,7 +254,7 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean, Fi
request.removeAttribute(FILTER_APPLIED); request.removeAttribute(FILTER_APPLIED);
storeSecurityContextInSession(contextAfterChainExecution, request, storeSecurityContextInSession(contextAfterChainExecution, request,
httpSessionExistedAtStartOfRequest, contextHashWhenChainProceeded); httpSessionExistedAtStartOfRequest, contextHashBeforeChainExecution);
if (logger.isDebugEnabled()) { if (logger.isDebugEnabled()) {
logger.debug("SecurityContextHolder now cleared, as request processing completed"); logger.debug("SecurityContextHolder now cleared, as request processing completed");