SEC-1307, SEC-1528)if(httpSession !=null) {// We may have a new session, so check also whether the context attribute// is set SEC-1561// 这里就是把SecurityContext保存到session里,// 注意保存前有一个判断context是否发生变化的方法 c
+ springSecurityContextKey + ": '" + contextFromSession + "'"); } // Everything OK. The only non-null return from this method. return (SecurityContext) contextFromSession; } 可以看到是从session中取出名为SPRING_SECURITY_CONTEXT的attribute 取出来是SecurityContextImpl,实例如下 org.springframework...
+ "(you should always use SecurityContextHolder) or using the HttpSession attribute " + "reserved for this class?"); } return null; } if (debug) { logger.debug("Obtained a valid SecurityContext from " + springSecurityContextKey + ": '" + contextFromSession + "'"); } // Everything...
When I stepped through Spring Security to figure out why the session being disabled was breaking it, it was the same root cause as this issue -- the authentication is being saved in a construct associated with the session and not the request, and something is happening between the "user lev...
通过源码中的注释,应该可以看出来,这个Filter的作用主要是创建一个空的SecurityContext(如果session中没有SecurityContext实例),然后持久化到session中。 接下来看看repo.loadContext(holder);代码: public SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder) { ...
DEBUG [http-apr-8080-exec-55] (AbstractBeanFactory.java:246) - Returning cached instance of singleton bean 'org.springframework.security.core.session.SessionRegistryImpl#0' DEBUG [http-apr-8080-exec-55] (AbstractFallbackTransactionAttributeSource.java:106) - Adding transactional method 'rowCount' wi...
// We may have a new session, so check also whether the context attribute // is set SEC-1561 if (contextChanged(context) || httpSession.getAttribute(springSecurityContextKey) == null) { // HttpSession 中存储SecurityContext httpSession.setAttribute(springSecurityContextKey, context); ...
springSecurityContextKey + " did not contain a SecurityContext but contained: '" + contextFromSession + "'; are you improperly modifying the HttpSession directly (you should always use SecurityContextHolder) or using the HttpSession attribute reserved for this class?"); } return null; } else...
=null) {// We may have a new session, so check also whether the context attribute// is set SEC-1561if(contextChanged(context) || httpSession.getAttribute(springSecurityContextKey) ==null) {// HttpSession 中存储SecurityContexthttpSession.setAttribute(springSecurityContextKey, context);this.is...
setAuthentication(new UsernamePasswordAuthenticationToken("test", "notused", AuthorityUtils.createAuthorityList("ROLE_USER"))); this.request.getSession().setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, securityContext); this.springSecurityFilterChain.doFilter(this.reque...