In a Spring Security 3.2 based application I have a explicit configured UsernamePasswordAuthenticationFilter
, that need an reference to the sessionAuthenticationStrategy
(in order to invoke .onAuthentication
).*
The sessionAuthenticationStrategy
is the default one created by <security:http>
(HttpSecurityBeanDefinitionParser
).
My question: Is how can I get an reference to the SessionAuthenticationStrategy
without configuring the complete SessionAuthenticationStrategy
explicite, so that I can inject this reference in XML configuration?
<security:http auto-config="false" use-expressions="true"
entry-point-ref="loginUrlAuthenticationEntryPoint"
access-decision-manager-ref="httpAccessDecisionManager">
...
<security:custom-filter
ref="usernamePasswordAuthenticationFilter"
position="FORM_LOGIN_FILTER"/>
...
</security:http>
...
<bean id="usernamePasswordAuthenticationFilter"
class=" o.s.scurity.web.authentication.UsernamePasswordAuthenticationFilter">
<property name="sessionAuthenticationStrategy" ref="????"> <!-- ?? ->
...
</bean>
*my real UsernamePasswordAuthenticationFilter
is a customized subclass, but that should not matter for this question
By default, Spring Security will create a session when it needs one — this is “ifRequired“. For a more stateless application, the “never” option will ensure that Spring Security itself won't create any session. But if the application creates one, Spring Security will make use of it.
Interface SessionAuthenticationStrategyAllows pluggable support for HttpSession-related behaviour when an authentication occurs. Typical use would be to make sure a session exists or to change the session Id to guard against session-fixation attacks.
Enum SessionCreationPolicySpecifies the various session creation policies for Spring Security.
getSessionId(); This relies on Spring's RequestContextHolder , so it should be used with Spring MVC's DispatcherServlet or you should have a RequestContextListener declared. Also session will be created if not exists.
When working with JavaConfig (I'm afraid is not your case) you can get a reference by doing
http.getConfigurer(SessionManagementConfigurer.class).init(http);
http.getSharedObject(SessionAuthenticationStrategy.class);
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With