Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Transient Authentication Tokens

Browse Source 
This commit introduces support for transient authentication tokens
which indicate to the filter chain, specifically the
HttpSessionSecurityContextRepository, whether or not the token ought
to be persisted across requests.

To leverage this, simply annotate any Authentication implementation
with @TransientAuthentication, extend from an Authentication that uses
this annotation, or annotate a custom annotation.

Implementations of SecurityContextRepository may choose to not persist
tokens that are marked with @TransientAuthentication in the same way
that HttpSessionSecurityContextRepository does.

Fixes: gh-5481
This commit is contained in:
Josh Cummings
2018-06-11 22:52:46 -06:00
committed by Rob Winch
parent 371221d729
commit 3c46727be1
8 changed files with 513 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java
View File

@@ -25,9 +25,12 @@ import javax.servlet.http.HttpSession;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.core.annotation.AnnotationUtils;
import org.springframework.security.authentication.AuthenticationTrustResolver;
import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.TransientAuthentication;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.context.SecurityContextHolderStrategy;
@@ -387,6 +390,10 @@ public class HttpSessionSecurityContextRepository implements SecurityContextRepo
}
private HttpSession createNewSessionIfAllowed(SecurityContext context) {
if (isTransientAuthentication(context.getAuthentication())) {
return null;
}
if (httpSessionExistedAtStartOfRequest) {
if (logger.isDebugEnabled()) {
logger.debug("HttpSession is now null, but was not null at start of request; "
@@ -437,6 +444,10 @@ public class HttpSessionSecurityContextRepository implements SecurityContextRepo
}
}
private boolean isTransientAuthentication(Authentication authentication) {
return AnnotationUtils.getAnnotation(authentication.getClass(), TransientAuthentication.class) != null;
}
/**
* Sets the {@link AuthenticationTrustResolver} to be used. The default is
* {@link AuthenticationTrustResolverImpl}.