HttpSessionSecurityContextRepository - No HttpSession currently exists

Question

Currently, I have No HttpSession currently exists. I believe this problem causes inconsistent login bug. I can login successfully some times, but others I cannot. Please help. Any suggestions are welcome.

I have two tables in database: customer and vendor. In my security.xml file, I setup in a way that it checks for the vendor table first; if it is not successful, it will check for the customer table. I'm not sure if it is the best practice, but it's working for me.

One more thing is that No HttpSession never happens in my localhost:8080 environment. But it does in production.

This is my setup: Spring mvc, Tomcat, Postgresql, and Heroku is my cloud service.

Here are my spring mvc and spring security versions

<properties>
        <spring.version>4.0.5.RELEASE</spring.version>
        <apache.tiles>3.0.3</apache.tiles>
        <spring.security.version>3.2.3.RELEASE</spring.security.version>
    </properties>

This is my spring.xml file

<global-method-security pre-post-annotations="enabled" />

    <http use-expressions="true" auto-config="true">
        <intercept-url pattern="/login.html" requires-channel="https"/>
        <intercept-url pattern="/logout.html" requires-channel="https"/>
        <intercept-url pattern="/vendor/admin/**" access="hasRole('ROLE_ADMIN')" requires-channel="https"/>
        <intercept-url pattern="/vendor/admin**" access="hasRole('ROLE_ADMIN')" requires-channel="https"/>
        <intercept-url pattern="/vendor/account/**" access="hasRole('ROLE_VENDOR')" requires-channel="https"/>
        <intercept-url pattern="/vendor/account**" access="hasRole('ROLE_VENDOR')" requires-channel="https"/>
        <!-- Customer section -->
        <intercept-url pattern="/customer/account/" access="hasRole('ROLE_CUSTOMER')" requires-channel="https"/>
        <intercept-url pattern="/customer/account**" access="hasRole('ROLE_CUSTOMER')" requires-channel="https"/>
        <intercept-url pattern="/reservation/ordercomplete/**" access="hasRole('ROLE_CUSTOMER')" requires-channel="https"/>
        <intercept-url pattern="/reservation/ordercomplete**" access="hasRole('ROLE_CUSTOMER')" requires-channel="https"/>

        <form-login login-page="/login.html" 
                    authentication-failure-url="/login.html?success=false"
                    authentication-success-handler-ref="knexAuthenticationSuccessHandler" />

        <logout logout-url="/logout" delete-cookies="JSESSIONID" />


        <session-management>
                <concurrency-control max-sessions="1" error-if-maximum-exceeded="false" />
        </session-management>
    </http>

    <beans:bean id="knexAuthenticationSuccessHandler"
        class="com.knexpress.cabo.security.KNexUrlAuthenticationSuccessHandler" />


    <authentication-manager>
        <authentication-provider>
            <password-encoder hash="bcrypt" />
            <jdbc-user-service data-source-ref="dataSource"
                authorities-by-username-query="the query here is working ok"
                users-by-username-query="select username, password, enabled from vendor where username = ? " />
        </authentication-provider>
        <authentication-provider>
            <password-encoder hash="bcrypt" />
            <jdbc-user-service data-source-ref="dataSource"
                authorities-by-username-query="the query here is working alright."
                users-by-username-query="select email, password, enabled from customer where email = ? " />
        </authentication-provider>
    </authentication-manager>

This is my applicationContext.xml file

<context:component-scan base-package="com.knexpress.cabo">
        <context:exclude-filter type="annotation"
            expression="org.springframework.stereotype.Controller" />
    </context:component-scan>

    <tx:annotation-driven transaction-manager="transactionManager" />

    <bean id="transactionManager" class="org.springframework.orm.jpa.JpaTransactionManager">
        <property name="dataSource" ref="dataSource" />
    </bean>

    <jpa:repositories base-package="com.knexpress.cabo.repository" />

    <!-- Using this to serve https pages --> 
    <bean id="loadBalancerHack" class="com.knexpress.cabo.component.LoadBalancerHack"/> 

    <bean id="secureChannelProcessorHack" class="com.knexpress.cabo.component.SecureChannelProcessorHack"/>
    <bean id="insecureChannelProcessorHack" class="com.knexpress.cabo.component.InsecureChannelProcessorHack"/> 

    <import resource="security.xml" />

And this is my web.xml file

<servlet>
        <servlet-name>dispatcher</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>dispatcher</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <listener>
        <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
    </listener>

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <context-param>
        <param-name>defaultHtmlEscape</param-name>
        <param-value>true</param-value>
    </context-param>

    <context-param>
        <param-name>spring.profiles.default</param-name>
        <param-value>prod</param-value>
    </context-param>

    <session-config>
        <!-- Default to 5 minute session timeouts -->
        <session-timeout>5</session-timeout>
    </session-config>

And lastly, this is my logs in production. (BTW: I did not activate logs for all of my queries in prod environment:

2016-02-18T12:43:17.237730+00:00 app[web.2]: DEBUG [18.02.16 12:43:17] AntPathRequestMatcher - Checking match of request : '/index.html'; against '/customer/account/' [thread: http-nio-30156-exec-4]
2016-02-18T12:43:17.241374+00:00 app[web.2]: DEBUG [18.02.16 12:43:17] FilterChainProxy$VirtualFilterChain - /index.html at position 2 of 13 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' [thread: http-nio-30156-exec-4]
2016-02-18T12:43:17.241508+00:00 app[web.2]: DEBUG [18.02.16 12:43:17] HttpSessionSecurityContextRepository - No HttpSession currently exists [thread: http-nio-30156-exec-4]
2016-02-18T12:43:17.241631+00:00 app[web.2]: DEBUG [18.02.16 12:43:17] HttpSessionSecurityContextRepository - No SecurityContext was available from the HttpSession: null. A new one will be created. [thread: http-nio-30156-exec-4]
2016-02-18T12:43:17.241749+00:00 app[web.2]: DEBUG [18.02.16 12:43:17] FilterChainProxy$VirtualFilterChain - /index.html at position 3 of 13 in additional filter chain; firing Filter: 'ConcurrentSessionFilter' [thread: http-nio-30156-exec-4]
2016-02-18T12:43:17.241930+00:00 app[web.2]: DEBUG [18.02.16 12:43:17] FilterChainProxy$VirtualFilterChain - /index.html at position 4 of 13 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter' [thread: http-nio-30156-exec-4]
2016-02-18T12:43:17.242298+00:00 app[web.2]: DEBUG [18.02.16 12:43:17] FilterChainProxy$VirtualFilterChain - /index.html at position 5 of 13 in additional filter chain; firing Filter: 'LogoutFilter' [thread: http-nio-30156-exec-4]
2016-02-18T12:43:17.242414+00:00 app[web.2]: DEBUG [18.02.16 12:43:17] FilterChainProxy$VirtualFilterChain - /index.html at position 6 of 13 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter' [thread: http-nio-30156-exec-4]
2016-02-18T12:43:17.242950+00:00 app[web.2]: DEBUG [18.02.16 12:43:17] FilterChainProxy$VirtualFilterChain - /index.html at position 7 of 13 in additional filter chain; firing Filter: 'BasicAuthenticationFilter' [thread: http-nio-30156-exec-4]
2016-02-18T12:43:17.247152+00:00 app[web.2]: ERROR [18.02.16 12:43:17] CustomerHomeController -  [thread: http-nio-30156-exec-4]
2016-02-18T12:43:17.265654+00:00 app[web.2]: DEBUG [18.02.16 12:43:17] ExceptionTranslationFilter - Chain processed normally [thread: http-nio-30156-exec-4]
2016-02-18T12:43:17.268379+00:00 app[web.2]: DEBUG [18.02.16 12:43:17] SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed [thread: http-nio-30156-exec-4]
2016-02-18T12:43:17.238551+00:00 app[web.2]: DEBUG [18.02.16 12:43:17] AntPathRequestMatcher - Checking match of request : '/index.html'; against '/customer/account**' [thread: http-nio-30156-exec-4]
2016-02-18T12:43:17.238669+00:00 app[web.2]: DEBUG [18.02.16 12:43:17] AntPathRequestMatcher - Checking match of request : '/index.html'; against '/reservation/ordercomplete/**' [thread: http-nio-30156-exec-4]
2016-02-18T12:43:17.239353+00:00 app[web.2]: DEBUG [18.02.16 12:43:17] AntPathRequestMatcher - Checking match of request : '/index.html'; against '/reservation/ordercomplete**' [thread:

Answer 1

I had the same problem, you have to set in your Tomcat context file or apache Server config the parameter sessionCookiePath to keep the Session id.

<Context sessionCookiePath="/"> for Tomcat file

ProxyPassReverseCookiePath "/" for Apache config