Skip to content

Commit 772f29e

Browse files
jzheauxjzheaux
committed
Polish SecurityContextHolderStrategy for Defaults
gh-11060
1 parent 8d681b3 commit 772f29e

6 files changed

+86
-11
lines changed

‎web/src/main/java/org/springframework/security/web/authentication/logout/SecurityContextLogoutHandler.java

+17-2
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
import org.springframework.security.core.Authentication;
2828
import org.springframework.security.core.context.SecurityContext;
2929
import org.springframework.security.core.context.SecurityContextHolder;
30+
import org.springframework.security.core.context.SecurityContextHolderStrategy;
3031
import org.springframework.util.Assert;
3132

3233
/**
@@ -46,6 +47,9 @@ public class SecurityContextLogoutHandler implements LogoutHandler {
4647

4748
protected final Log logger = LogFactory.getLog(this.getClass());
4849

50+
private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
51+
.getContextHolderStrategy();
52+
4953
private boolean invalidateHttpSession = true;
5054

5155
private boolean clearAuthentication = true;
@@ -68,8 +72,8 @@ public void logout(HttpServletRequest request, HttpServletResponse response, Aut
6872
}
6973
}
7074
}
71-
SecurityContext context = SecurityContextHolder.getContext();
72-
SecurityContextHolder.clearContext();
75+
SecurityContext context = this.securityContextHolderStrategy.getContext();
76+
this.securityContextHolderStrategy.clearContext();
7377
if (this.clearAuthentication) {
7478
context.setAuthentication(null);
7579
}
@@ -79,6 +83,17 @@ public boolean isInvalidateHttpSession() {
7983
return this.invalidateHttpSession;
8084
}
8185

86+
/**
87+
* Sets the {@link SecurityContextHolderStrategy} to use. The default action is to use
88+
* the {@link SecurityContextHolderStrategy} stored in {@link SecurityContextHolder}.
89+
*
90+
* @since 5.8
91+
*/
92+
public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
93+
Assert.notNull(securityContextHolderStrategy, "securityContextHolderStrategy cannot be null");
94+
this.securityContextHolderStrategy = securityContextHolderStrategy;
95+
}
96+
8297
/**
8398
* Causes the {@link HttpSession} to be invalidated when this {@link LogoutHandler} is
8499
* invoked. Defaults to true.

‎web/src/main/java/org/springframework/security/web/method/annotation/AuthenticationPrincipalArgumentResolver.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2021 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.

‎web/src/main/java/org/springframework/security/web/method/annotation/CurrentSecurityContextArgumentResolver.java

+17-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2019 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -28,6 +28,7 @@
2828
import org.springframework.security.core.annotation.CurrentSecurityContext;
2929
import org.springframework.security.core.context.SecurityContext;
3030
import org.springframework.security.core.context.SecurityContextHolder;
31+
import org.springframework.security.core.context.SecurityContextHolderStrategy;
3132
import org.springframework.stereotype.Controller;
3233
import org.springframework.util.Assert;
3334
import org.springframework.util.StringUtils;
@@ -75,6 +76,9 @@
7576
*/
7677
public final class CurrentSecurityContextArgumentResolver implements HandlerMethodArgumentResolver {
7778

79+
private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
80+
.getContextHolderStrategy();
81+
7882
private ExpressionParser parser = new SpelExpressionParser();
7983

8084
private BeanResolver beanResolver;
@@ -87,7 +91,7 @@ public boolean supportsParameter(MethodParameter parameter) {
8791
@Override
8892
public Object resolveArgument(MethodParameter parameter, ModelAndViewContainer mavContainer,
8993
NativeWebRequest webRequest, WebDataBinderFactory binderFactory) {
90-
SecurityContext securityContext = SecurityContextHolder.getContext();
94+
SecurityContext securityContext = this.securityContextHolderStrategy.getContext();
9195
if (securityContext == null) {
9296
return null;
9397
}
@@ -113,6 +117,17 @@ public Object resolveArgument(MethodParameter parameter, ModelAndViewContainer m
113117
return securityContextResult;
114118
}
115119

120+
/**
121+
* Sets the {@link SecurityContextHolderStrategy} to use. The default action is to use
122+
* the {@link SecurityContextHolderStrategy} stored in {@link SecurityContextHolder}.
123+
*
124+
* @since 5.8
125+
*/
126+
public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
127+
Assert.notNull(securityContextHolderStrategy, "securityContextHolderStrategy cannot be null");
128+
this.securityContextHolderStrategy = securityContextHolderStrategy;
129+
}
130+
116131
/**
117132
* Set the {@link BeanResolver} to be used on the expressions
118133
* @param beanResolver the {@link BeanResolver} to use

‎web/src/main/java/org/springframework/security/web/servletapi/HttpServlet3RequestFactory.java

+19-5
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
import org.springframework.security.core.AuthenticationException;
4343
import org.springframework.security.core.context.SecurityContext;
4444
import org.springframework.security.core.context.SecurityContextHolder;
45+
import org.springframework.security.core.context.SecurityContextHolderStrategy;
4546
import org.springframework.security.web.AuthenticationEntryPoint;
4647
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
4748
import org.springframework.security.web.authentication.logout.LogoutHandler;
@@ -77,6 +78,9 @@ final class HttpServlet3RequestFactory implements HttpServletRequestFactory {
7778

7879
private Log logger = LogFactory.getLog(getClass());
7980

81+
private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
82+
.getContextHolderStrategy();
83+
8084
private final String rolePrefix;
8185

8286
private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
@@ -162,9 +166,17 @@ void setTrustResolver(AuthenticationTrustResolver trustResolver) {
162166
this.trustResolver = trustResolver;
163167
}
164168

169+
void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
170+
Assert.notNull(securityContextHolderStrategy, "securityContextHolderStrategy cannot be null");
171+
this.securityContextHolderStrategy = securityContextHolderStrategy;
172+
}
173+
165174
@Override
166175
public HttpServletRequest create(HttpServletRequest request, HttpServletResponse response) {
167-
return new Servlet3SecurityContextHolderAwareRequestWrapper(request, this.rolePrefix, response);
176+
Servlet3SecurityContextHolderAwareRequestWrapper wrapper = new Servlet3SecurityContextHolderAwareRequestWrapper(
177+
request, this.rolePrefix, response);
178+
wrapper.setSecurityContextHolderStrategy(this.securityContextHolderStrategy);
179+
return wrapper;
168180
}
169181

170182
private class Servlet3SecurityContextHolderAwareRequestWrapper extends SecurityContextHolderAwareRequestWrapper {
@@ -229,9 +241,10 @@ public void login(String username, String password) throws ServletException {
229241
return;
230242
}
231243
Authentication authentication = getAuthentication(authManager, username, password);
232-
SecurityContext context = SecurityContextHolder.createEmptyContext();
244+
SecurityContext context = HttpServlet3RequestFactory.this.securityContextHolderStrategy
245+
.createEmptyContext();
233246
context.setAuthentication(authentication);
234-
SecurityContextHolder.setContext(context);
247+
HttpServlet3RequestFactory.this.securityContextHolderStrategy.setContext(context);
235248
}
236249

237250
private Authentication getAuthentication(AuthenticationManager authManager, String username, String password)
@@ -244,7 +257,7 @@ private Authentication getAuthentication(AuthenticationManager authManager, Stri
244257
return authManager.authenticate(authentication);
245258
}
246259
catch (AuthenticationException ex) {
247-
SecurityContextHolder.clearContext();
260+
HttpServlet3RequestFactory.this.securityContextHolderStrategy.clearContext();
248261
throw new ServletException(ex.getMessage(), ex);
249262
}
250263
}
@@ -258,7 +271,8 @@ public void logout() throws ServletException {
258271
super.logout();
259272
return;
260273
}
261-
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
274+
Authentication authentication = HttpServlet3RequestFactory.this.securityContextHolderStrategy.getContext()
275+
.getAuthentication();
262276
for (LogoutHandler handler : handlers) {
263277
handler.logout(this, this.response, authentication);
264278
}

‎web/src/main/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestFilter.java

+16
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
3333
import org.springframework.security.core.context.SecurityContext;
3434
import org.springframework.security.core.context.SecurityContextHolder;
35+
import org.springframework.security.core.context.SecurityContextHolderStrategy;
3536
import org.springframework.security.web.AuthenticationEntryPoint;
3637
import org.springframework.security.web.authentication.logout.LogoutHandler;
3738
import org.springframework.util.Assert;
@@ -68,6 +69,9 @@
6869
*/
6970
public class SecurityContextHolderAwareRequestFilter extends GenericFilterBean {
7071

72+
private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
73+
.getContextHolderStrategy();
74+
7175
private String rolePrefix = "ROLE_";
7276

7377
private HttpServletRequestFactory requestFactory;
@@ -80,6 +84,17 @@ public class SecurityContextHolderAwareRequestFilter extends GenericFilterBean {
8084

8185
private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
8286

87+
/**
88+
* Sets the {@link SecurityContextHolderStrategy} to use. The default action is to use
89+
* the {@link SecurityContextHolderStrategy} stored in {@link SecurityContextHolder}.
90+
*
91+
* @since 5.8
92+
*/
93+
public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
94+
Assert.notNull(securityContextHolderStrategy, "securityContextHolderStrategy cannot be null");
95+
this.securityContextHolderStrategy = securityContextHolderStrategy;
96+
}
97+
8398
public void setRolePrefix(String rolePrefix) {
8499
Assert.notNull(rolePrefix, "Role prefix must not be null");
85100
this.rolePrefix = rolePrefix;
@@ -178,6 +193,7 @@ private HttpServletRequestFactory createServlet3Factory(String rolePrefix) {
178193
factory.setAuthenticationEntryPoint(this.authenticationEntryPoint);
179194
factory.setAuthenticationManager(this.authenticationManager);
180195
factory.setLogoutHandlers(this.logoutHandlers);
196+
factory.setSecurityContextHolderStrategy(this.securityContextHolderStrategy);
181197
return factory;
182198
}
183199

‎web/src/main/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestWrapper.java

+16-1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import org.springframework.security.core.Authentication;
2929
import org.springframework.security.core.GrantedAuthority;
3030
import org.springframework.security.core.context.SecurityContextHolder;
31+
import org.springframework.security.core.context.SecurityContextHolderStrategy;
3132
import org.springframework.security.core.userdetails.UserDetails;
3233
import org.springframework.util.Assert;
3334

@@ -50,6 +51,9 @@
5051
*/
5152
public class SecurityContextHolderAwareRequestWrapper extends HttpServletRequestWrapper {
5253

54+
private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
55+
.getContextHolderStrategy();
56+
5357
private final AuthenticationTrustResolver trustResolver;
5458

5559
/**
@@ -88,7 +92,7 @@ public SecurityContextHolderAwareRequestWrapper(HttpServletRequest request,
8892
* @return the authentication object or <code>null</code>
8993
*/
9094
private Authentication getAuthentication() {
91-
Authentication auth = SecurityContextHolder.getContext().getAuthentication();
95+
Authentication auth = this.securityContextHolderStrategy.getContext().getAuthentication();
9296
return (!this.trustResolver.isAnonymous(auth)) ? auth : null;
9397
}
9498

@@ -169,4 +173,15 @@ public String toString() {
169173
return "SecurityContextHolderAwareRequestWrapper[ " + getRequest() + "]";
170174
}
171175

176+
/**
177+
* Sets the {@link SecurityContextHolderStrategy} to use. The default action is to use
178+
* the {@link SecurityContextHolderStrategy} stored in {@link SecurityContextHolder}.
179+
*
180+
* @since 5.8
181+
*/
182+
public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
183+
Assert.notNull(securityContextHolderStrategy, "securityContextHolderStrategy cannot be null");
184+
this.securityContextHolderStrategy = securityContextHolderStrategy;
185+
}
186+
172187
}

0 commit comments

Comments
 (0)