Skip to content

RememberMeAuthenticationFilter does not use SecurityContextRepository configured in HttpSecurity #13104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
kzwang opened this issue Apr 26, 2023 · 0 comments
Closed

RememberMeAuthenticationFilter does not use SecurityContextRepository configured in HttpSecurity #13104

kzwang opened this issue Apr 26, 2023 · 0 comments
Assignees
@jzheaux
Labels
in: config An issue in spring-security-config type: bug A general bug
Milestone
5.8.4

Comments

@kzwang
Copy link

kzwang commented Apr 26, 2023

We are configuring HttpSecurity to use a different SecurityContextRepository via http.securityContext().securityContextRepository(new NullSecurityContextRepository());. However, RememberMeAuthenticationFilter would still use HttpSessionSecurityContextRepository instead of the NullSecurityContextRepository we configured.

It seems the SecurityContextRepository set in HttpSecurity is not been propagated to RememberMeAuthenticationFilter in https://github.com/spring-projects/spring-security/blob/main/config/src/main/java/org/springframework/security/config/annotation/web/configurers/RememberMeConfigurer.java#L291
@kzwang kzwang added status: waiting-for-triage An issue we've not yet triaged type: bug A general bug labels Apr 26, 2023
@jzheaux jzheaux added in: config An issue in spring-security-config and removed status: waiting-for-triage An issue we've not yet triaged labels May 1, 2023
@jzheaux jzheaux self-assigned this May 1, 2023
@jzheaux jzheaux modified the milestones: 6.1.0, 5.8.4 May 1, 2023
jzheaux added a commit to jzheaux/spring-security that referenced this issue May 2, 2023
@jzheaux
RememberMeConfigurer Picks Up SecurityContextRepository
5056c46 
Closes spring-projectsgh-13104
@jzheaux jzheaux mentioned this issue May 2, 2023
Closed
@jzheaux jzheaux closed this as completed in e9a02bc May 2, 2023
@marcusdacoregio marcusdacoregio mentioned this issue May 8, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jzheaux jzheaux

Labels
in: config An issue in spring-security-config type: bug A general bug
Projects
Spring Security Team
Status: Done
Milestone
5.8.4
Development

No branches or pull requests
2 participants
@kzwang @jzheaux