http.requestCache().disable() not working

[beku8]

Summary

http.requestCache().disable() is not working in spring security 5.0.8

Actual Behavior

http.requestCache().disable() is not disabling cache. We can see that from the log:

2018-11-16 11:28:28.436 DEBUG 18378 --- [nio-8080-exec-3] o.s.s.w.s.HttpSessionRequestCache        : DefaultSavedRequest added to Session: DefaultSavedRequest[http://localhost:8080/actuator]
2018-11-16 11:28:28.436 DEBUG 18378 --- [nio-8080-exec-3] o.s.s.w.a.ExceptionTranslationFilter     : Calling Authentication entry point.

Expected Behavior

I expect this config to be disabling the request cache.

Configuration

I tried in a very simple spring boot app to confirm:

@SpringBootApplication
@EnableWebSecurity
public class BasicauthdemoApplication {

	public static void main(String[] args) {
		SpringApplication.run(BasicauthdemoApplication.class, args);
	}
	
	@Configuration
  public static class HttpBasicSecurityConfig extends WebSecurityConfigurerAdapter {
    
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
      http
        .requestMatchers()
          .requestMatchers(EndpointRequest.toAnyEndpoint())
      .and()
        .authorizeRequests()
        .requestMatchers(EndpointRequest.to("health", "info")).permitAll()
        .requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ACTUATOR")
        .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()
        .antMatchers("/error").permitAll() // To give proper error on failed authentication, https://github.com/spring-projects/spring-security/issues/4467
        .anyRequest().hasRole("ACTUATOR")
      .and()
        .httpBasic()
      .and()
        .requestCache().disable()
        .csrf().disable();
      
      
    }  

  }
}

Version

5.0.8

Sample

https://github.com/beku8/basicauthdemo

[rwinch]

Thanks for the report @beku8! You can work around this by explicitly setting the cache to be NullRequestCache. For example:

http
    ...
    .requestCache()
        .requestCache(new NullRequestCache());