Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1998: SecurityContextCallableProcessingInterceptor uses postProcess

Browse Source 
Previously SecurityContextCallableProcessingInterceptor used afterCompletion
to clear the SecurityContextHolder. This does not work since afterCompletion
is invoked on the Servlet Container thread.

Now SecurityContextCallableProcessingInterceptor clears the
SecurityContextHolder on postProcess which is invoked on the same thread
that the Callable is processed on.
This commit is contained in:
Rob Winch
2012-12-06 12:59:21 -06:00
parent 796de42105
commit 3437ef714a
3 changed files with 23 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
web/src/test/java/org/springframework/security/web/context/request/async/SecurityContextCallableProcessingInterceptorTests.java
View File

@@ -59,7 +59,7 @@ public class SecurityContextCallableProcessingInterceptorTests {
interceptor.preProcess(webRequest, callable);
assertThat(SecurityContextHolder.getContext()).isSameAs(securityContext);
interceptor.afterCompletion(webRequest, callable);
interceptor.postProcess(webRequest, callable, null);
assertThat(SecurityContextHolder.getContext()).isNotSameAs(securityContext);
}
@@ -71,7 +71,7 @@ public class SecurityContextCallableProcessingInterceptorTests {
interceptor.preProcess(webRequest, callable);
assertThat(SecurityContextHolder.getContext()).isSameAs(securityContext);
interceptor.afterCompletion(webRequest, callable);
interceptor.postProcess(webRequest, callable, null);
assertThat(SecurityContextHolder.getContext()).isNotSameAs(securityContext);
}
}

16
web/src/test/java/org/springframework/security/web/context/request/async/WebAsyncManagerIntegrationFilterTests.java
View File

@@ -31,7 +31,9 @@ import org.springframework.core.task.SimpleAsyncTaskExecutor;
import org.springframework.mock.web.MockFilterChain;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.context.request.NativeWebRequest;
import org.springframework.web.context.request.async.AsyncWebRequest;
import org.springframework.web.context.request.async.CallableProcessingInterceptorAdapter;
import org.springframework.web.context.request.async.WebAsyncManager;
import org.springframework.web.context.request.async.WebAsyncUtils;
@@ -84,6 +86,13 @@ public class WebAsyncManagerIntegrationFilterTests {
@Test
public void doFilterInternalRegistersSecurityContextCallableProcessor() throws Exception {
SecurityContextHolder.setContext(securityContext);
asyncManager.registerCallableInterceptors(new CallableProcessingInterceptorAdapter() {
@Override
public <T> void postProcess(NativeWebRequest request, Callable<T> task, Object concurrentResult)
throws Exception {
assertThat(SecurityContextHolder.getContext()).isNotSameAs(securityContext);
}
});
filter.doFilterInternal(request, response, filterChain);
VerifyingCallable verifyingCallable = new VerifyingCallable();
@@ -95,6 +104,13 @@ public class WebAsyncManagerIntegrationFilterTests {
@Test
public void doFilterInternalRegistersSecurityContextCallableProcessorContextUpdated() throws Exception {
SecurityContextHolder.setContext(SecurityContextHolder.createEmptyContext());
asyncManager.registerCallableInterceptors(new CallableProcessingInterceptorAdapter() {
@Override
public <T> void postProcess(NativeWebRequest request, Callable<T> task, Object concurrentResult)
throws Exception {
assertThat(SecurityContextHolder.getContext()).isNotSameAs(securityContext);
}
});
filter.doFilterInternal(request, response, filterChain);
SecurityContextHolder.setContext(securityContext);