Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Adjust createNewSessionIfAllowed to prevent NPE

Browse Source 
Ensure that isTransientAuthentication reuses the same authentication object from saveContext

Closes gh-8947
This commit is contained in:
Marcus Hert da Coregio
2021-05-26 09:03:38 -03:00
committed by Josh Cummings
parent cf74ad3a52
commit 2a7998d0fc
2 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2016 the original author or authors.
* Copyright 2002-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -348,7 +348,7 @@ public class HttpSessionSecurityContextRepository implements SecurityContextRepo
}
return;
}
httpSession = (httpSession != null) ? httpSession : createNewSessionIfAllowed(context);
httpSession = (httpSession != null) ? httpSession : createNewSessionIfAllowed(context, authentication);
// If HttpSession exists, store current SecurityContext but only if it has
// actually changed in this thread (see SEC-37, SEC-1307, SEC-1528)
if (httpSession != null) {
@@ -369,8 +369,8 @@ public class HttpSessionSecurityContextRepository implements SecurityContextRepo
|| context.getAuthentication() != this.authBeforeExecution;
}
private HttpSession createNewSessionIfAllowed(SecurityContext context) {
if (isTransientAuthentication(context.getAuthentication())) {
private HttpSession createNewSessionIfAllowed(SecurityContext context, Authentication authentication) {
if (isTransientAuthentication(authentication)) {
return null;
}
if (this.httpSessionExistedAtStartOfRequest) {