SEC-1394: Credentials stored in authentication object

[spring-projects-issues]

Jarrod Carlson (Migrated from SEC-1394) said:

Maybe I'm missing something obvious, but is there a reason that after a successful login (using the approach) the "credentials" from login (the user's password) are kept in clear text in the Authentication object stored in the SecurityContext?

After login, any part of my application can simply do:

SecurityContextHolder.getContext().getAuthenticati on().getCredentials();

This returns the plain-text password supplied at login, even if login was dozens of requests ago. Why is this? Does that not seem somewhat insecure to anyone else?

[rwinch]

This issue duplicates #1616