CODEWITHSUNDEEP
springspring-bootspring-securityspring-sessionjsessionid
samshers
samshers

Reputation: 3690

How does spring security maintain authentication information between request?

How does spring security maintain authentication info between requests?

Does it use any thing similar to jSessionId or uses an entirely different mechanism.

Further, I see that the AbstractSecurityInterceptor (I mean, any of it's implementations) is responsible for intercepting the incoming request and verify if a request is already authorized using Authentication.isAuthenticated() and then depending on the condition either validate the request or send the Authentication request to an AuthenticationManager Implementation. So, in other words, how does AbstractSecurityInterceptor differentiate between first request and subsequent request.

Upvotes: 2

Views: 2141

Answers (1)

M. Deinum
M. Deinum

Reputation: 125302

Spring Security uses a SecurityContextRepository to store and retrieve the SecurityContext for the current security session.

The default implementation is the HttpSessionSecurityContextRepository which utilizes the javax.servlet.http.HttpSession to store/retrieve the SecurityContext.

The underlying servlet container will obtain the correct HttpSession for the incoming request, generally due to a session identifier being passed in a cookie or request parameter. For Spring Security it doesn't matter as that is thus loaded of to the underlying servlet container.

Upvotes: 6

Related Questions