Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-539: Moved SecurityContextHolder.setContext() call into the try {} block to emphasize that it is only set for the duration of chain.doFilter() and immediately cleared afterwards. Changed the debug messages about setting the context, since it has not strictly taken place when they are logged.

This commit is contained in:
Luke Taylor 2007-08-28 23:11:58 +00:00
parent 47c5a6d43f
commit d7cef1ba31
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
core/src/main/java/org/acegisecurity/context/HttpSessionContextIntegrationFilter.java
View File

@ -219,25 +219,24 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean, Fi
contextBeforeChainExecution = generateNewContext(); contextBeforeChainExecution = generateNewContext();
if (logger.isDebugEnabled()) { if (logger.isDebugEnabled()) {
logger.debug("New SecurityContext instance associated with SecurityContextHolder"); logger.debug("New SecurityContext instance will be associated with SecurityContextHolder");
} }
} else { } else {
if (logger.isDebugEnabled()) { if (logger.isDebugEnabled()) {
logger.debug("Obtained a valid SecurityContext from ACEGI_SECURITY_CONTEXT and " logger.debug("Obtained a valid SecurityContext from ACEGI_SECURITY_CONTEXT to "
+ "set to SecurityContextHolder: '" + contextBeforeChainExecution + "'"); + "associate with SecurityContextHolder: '" + contextBeforeChainExecution + "'");
} }
} }
int contextHashBeforeChainExecution = contextBeforeChainExecution.hashCode(); int contextHashBeforeChainExecution = contextBeforeChainExecution.hashCode();
// This is the only place in this class where SecurityContextHolder.setContext() is called
SecurityContextHolder.setContext(contextBeforeChainExecution);
request.setAttribute(FILTER_APPLIED, Boolean.TRUE); request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
// Proceed with chain // Proceed with chain
try { try {
// This is the only place in this class where SecurityContextHolder.setContext() is called
SecurityContextHolder.setContext(contextBeforeChainExecution);
chain.doFilter(request, response); chain.doFilter(request, response);
} }
finally { finally {