Skip to content

Commit a5874d6

Browse files
nimakarimiankjzheaux
authored andcommitted
Fix SecurityContextPersistenceRepository Typo
1 parent 58725a4 commit a5874d6

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

docs/modules/ROOT/pages/servlet/authentication/persistence.adoc

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -197,13 +197,14 @@ image:{icondir}/number_1.png[] Before running the rest of the application, `Secu
197197

198198
image:{icondir}/number_2.png[] Next, the application is ran.
199199

200-
image:{icondir}/number_3.png[] Finally, if the `SecurityContext` has changed, we save the `SecurityContext` using the `SecurityContextPersistenceRepository`.
200+
image:{icondir}/number_3.png[] Finally, if the `SecurityContext` has changed, we save the `SecurityContext` using the `SecurityContextRepository`.
201201
This means that when using `SecurityContextPersistenceFilter`, just setting the `SecurityContextHolder` will ensure that the `SecurityContext` is persisted using `SecurityContextRepository`.
202202

203203
In some cases a response is committed and written to the client before the `SecurityContextPersistenceFilter` method completes.
204204
For example, if a redirect is sent to the client the response is immediately written back to the client.
205205
This means that establishing an `HttpSession` would not be possible in step 3 because the session id could not be included in the already written response.
206-
Another situation that can happen is that if a client authenticates successfully, the response is committed before `SecurityContextPersistenceFilter` completes, and the client makes a second request before the `SecurityContextPersistenceFilter` completes the wrong authentication could be present in the second request.
206+
Another situation that can happen is that if a client authenticates successfully, the response is committed before `SecurityContextPersistenceFilter` completes, and the client makes a second request before the `SecurityContextPersistenceFilter` completes. the wrong authentication could be present in the second request.
207+
207208

208209
To avoid these problems, the `SecurityContextPersistenceFilter` wraps both the `HttpServletRequest` and the `HttpServletResponse` to detect if the `SecurityContext` has changed and if so save the `SecurityContext` just before the response is committed.
209210

0 commit comments

Comments
 (0)