Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove Resource Server's Session Policy Config

Browse Source 
Resource Server doesn't need to set the session policy for the
application to STATELESS since it can rely on the
SessionManagementFilter ignoring token's annotated with @Transient,
which a JwtAuthenticationToken is.

Fixes: gh-5759
This commit is contained in:
Josh Cummings
2018-09-04 10:23:03 -06:00
parent 5141dacd95
commit 25d1f49d84
2 changed files with 50 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurer.java
View File

@@ -158,12 +158,6 @@ public final class OAuth2ResourceServerConfigurer<H extends HttpSecurityBuilder<
return this.jwtConfigurer;
}
@Override
public void setBuilder(H http) {
super.setBuilder(http);
initSessionCreationPolicy(http);
}
@Override
public void init(H http) throws Exception {
registerDefaultAccessDeniedHandler(http);
@@ -252,12 +246,6 @@ public final class OAuth2ResourceServerConfigurer<H extends HttpSecurityBuilder<
}
}
private void initSessionCreationPolicy(H http) {
if (http.getSharedObject(SessionCreationPolicy.class) == null) {
http.setSharedObject(SessionCreationPolicy.class, SessionCreationPolicy.STATELESS);
}
}
private void registerDefaultAccessDeniedHandler(H http) {
ExceptionHandlingConfigurer<H> exceptionHandling = http
.getConfigurer(ExceptionHandlingConfigurer.class);