1ab068a06d
Previously Spring Security did not save the Security Context immediately prior to the following methods being invoked: - HttpServletResonse.flushBuffer() - HttpServletResonse.getWriter().close() - HttpServletResonse.getWriter().flush() - HttpServletRespose.getOutputStream().close() - HttpServletRespose.getOutputStream().flush() This meant that the client could get a response prior to the SecurityContext being stored. After the client got the response, it would make another request and this would not yet be authenticated. The reason this can occur is because all of the above methods commit the response, which means that the server can signal to the client the response is completed. A similar issue happened in SEC-398. Now the previously listed methods are wrapped in order to ensure the SecurityContext is persisted prior to the response being committed. |
||
|---|---|---|
| .. | ||
| src | ||
| template.mf | ||
| web.gradle | ||