What is the replacement of AuthenticationException.getAuthentication() in Spring4.0.3

Question

I was using Spring 3 in my project and now upgraded to Spring 4.0.3.RELEASE. Now while using AuthenticationException.getAuthentication(), it says it is deprecated, but not able to find the alternative. Here is the code:

public ModelAndView init(HttpServletRequest request, HttpServletResponse response) {
    AuthenticationException exception = (AuthenticationException) request.getSession().getAttribute(WebAttributes.AUTHENTICATION_EXCEPTION);

    Authentication loginAuthentication = exception.getAuthentication();

    // Set the user name for the change password screen
    return new ModelAndView("common/changePassword", "userName", loginAuthentication.getPrincipal());   
}

Also the method setAuthentication(authentication) is deprecated. Is there any alternative for these two methods?

Answer 1

There is no replacement, because this method was a security risk.

The latest Javadoc for the 3.x releases says:

@deprecated to avoid potential leaking of sensitive information (e.g. through serialization/remoting).

Any code that relied on this will need a little re-thinking.