Package org.springframework.security.web.context

# Class HttpSessionSecurityContextRepository

java.lang.Object
org.springframework.security.web.context.HttpSessionSecurityContextRepository

All Implemented Interfaces:
  `SecurityContextRepository`

public class HttpSessionSecurityContextRepository extends Object implements SecurityContextRepository
A `SecurityContextRepository` implementation which stores the security context in the `HttpSession` between requests.

The `HttpSession` will be queried to retrieve the `SecurityContext` in the `loadContext` method (using the key `SPRING_SECURITY_CONTEXT_KEY` by default). If a valid `SecurityContext` cannot be obtained from the `HttpSession` for whatever reason, a fresh `SecurityContext` will be created by calling by `SecurityContextHolder.createEmptyContext()` and this instance will be returned instead.

When `saveContext` is called, the context will be stored under the same key, provided

1. The value has changed
2. The configured `AuthenticationTrustResolver` does not report that the contents represent an anonymous user

With the standard configuration, no `HttpSession` will be created during `loadContext` if one does not already exist. When `saveContext` is called at the end of the web request, and no session exists, a new `HttpSession` will only be created if the supplied `SecurityContext` is not equal to an empty `SecurityContext` instance. This avoids needless `HttpSession` creation, but automates the storage of changes made to the context during the request. Note that if `SecurityContextPersistenceFilter` is configured to eagerly create sessions, then the session-minimisation logic applied here will not make any difference. If you are using eager session creation, then you should ensure that the `allowSessionCreation` property of this class is set to `true` (the default).

If for whatever reason no `HttpSession` should ever be created (for example, if Basic authentication is being used or similar clients that will never present the same `jsessionid`), then `allowSessionCreation` should be set to `false`. Only do this if you really need to conserve server memory and ensure all classes using the `SecurityContextHolder` are designed to have no persistence of the `SecurityContext` between web requests.

Since:
  3.0

## Field Summary

Fields
Modifier and Type
Field
Description
`protected final org.apache.commons.logging.Log`
`logger`
`static final String`
`SPRING_SECURITY_CONTEXT_KEY`
The default key under which the security context will be stored in the session.

## Constructor Summary

Constructors
Constructor
Description
`HttpSessionSecurityContextRepository()`

## Method Summary

Modifier and Type
Method
Description
`boolean`
`containsContext(jakarta.servlet.http.HttpServletRequest request)`
Allows the repository to be queried as to whether it contains a security context for the current request.
`protected org.springframework.security.core.context.SecurityContext`
`generateNewContext()`
By default, calls `SecurityContextHolder.createEmptyContext()` to obtain a new context (there should be no context present in the holder when this method is called).
`org.springframework.security.core.context.SecurityContext`
`loadContext(HttpRequestResponseHolder requestResponseHolder)`
Gets the security context for the current request (if available) and returns it.
`org.springframework.security.core.context.DeferredSecurityContext`
`loadDeferredContext(jakarta.servlet.http.HttpServletRequest request)`
Defers loading the `SecurityContext` using the `HttpServletRequest` until it is needed by the application.
`void`
`saveContext(org.springframework.security.core.context.SecurityContext context, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)`
Stores the security context on completion of a request.
`void`
`setAllowSessionCreation(boolean allowSessionCreation)`
If set to true (the default), a session will be created (if required) to store the security context if it is determined that its contents are different from the default empty context value.
`void`
`setDisableUrlRewriting(boolean disableUrlRewriting)`
Allows the use of session identifiers in URLs to be disabled.
`void`
`setSecurityContextHolderStrategy(org.springframework.security.core.context.SecurityContextHolderStrategy strategy)`
Sets the `SecurityContextHolderStrategy` to use.
`void`
`setSpringSecurityContextKey(String springSecurityContextKey)`
Allows the session attribute name to be customized for this repository instance.
`void`
`setTrustResolver(org.springframework.security.authentication.AuthenticationTrustResolver trustResolver)`
Sets the `AuthenticationTrustResolver` to be used.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### SPRING_SECURITY_CONTEXT_KEY

public static final String SPRING_SECURITY_CONTEXT_KEY
The default key under which the security context will be stored in the session.

See Also:
  - Constant Field Values

### logger

protected final org.apache.commons.logging.Log logger

## Constructor Details

### HttpSessionSecurityContextRepository

public HttpSessionSecurityContextRepository()

## Method Details

### loadContext

public org.springframework.security.core.context.SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder)
Gets the security context for the current request (if available) and returns it.

If the session is null, the context object is null or the context object stored in the session is not an instance of `SecurityContext`, a new context object will be generated and returned.

Specified by:
  `loadContext` in interface `SecurityContextRepository`
Parameters:
  `requestResponseHolder` - holder for the current request and response for which the context should be loaded.
Returns:
  The security context which should be used for the current request, never null.

### loadDeferredContext

public org.springframework.security.core.context.DeferredSecurityContext loadDeferredContext(jakarta.servlet.http.HttpServletRequest request)
Description copied from interface: `SecurityContextRepository`
Defers loading the `SecurityContext` using the `HttpServletRequest` until it is needed by the application.

Specified by:
  `loadDeferredContext` in interface `SecurityContextRepository`
Parameters:
  `request` - the `HttpServletRequest` to load the `SecurityContext` from
Returns:
  a `DeferredSecurityContext` that returns the `SecurityContext` which cannot be null

### saveContext

public void saveContext(org.springframework.security.core.context.SecurityContext context, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
Description copied from interface: `SecurityContextRepository`
Stores the security context on completion of a request.

Specified by:
  `saveContext` in interface `SecurityContextRepository`
Parameters:
  `context` - the non-null context which was obtained from the holder.

### containsContext

public boolean containsContext(jakarta.servlet.http.HttpServletRequest request)
Description copied from interface: `SecurityContextRepository`
Allows the repository to be queried as to whether it contains a security context for the current request.

Specified by:
  `containsContext` in interface `SecurityContextRepository`
Parameters:
  `request` - the current request
Returns:
  true if a context is found for the request, false otherwise

### generateNewContext

protected org.springframework.security.core.context.SecurityContext generateNewContext()
By default, calls `SecurityContextHolder.createEmptyContext()` to obtain a new context (there should be no context present in the holder when this method is called). Using this approach the context creation strategy is decided by the `SecurityContextHolderStrategy` in use. The default implementations will return a new `SecurityContextImpl`.

Returns:
  a new SecurityContext instance. Never null.

### setAllowSessionCreation

public void setAllowSessionCreation(boolean allowSessionCreation)
If set to true (the default), a session will be created (if required) to store the security context if it is determined that its contents are different from the default empty context value.

Note that setting this flag to false does not prevent this class from storing the security context. If your application (or another filter) creates a session, then the security context will still be stored for an authenticated user.

Parameters:
  `allowSessionCreation` -

### setDisableUrlRewriting

public void setDisableUrlRewriting(boolean disableUrlRewriting)
Allows the use of session identifiers in URLs to be disabled. Off by default.

Parameters:
  `disableUrlRewriting` - set to `true` to disable URL encoding methods in the response wrapper and prevent the use of `jsessionid` parameters.

### setSpringSecurityContextKey

public void setSpringSecurityContextKey(String springSecurityContextKey)
Allows the session attribute name to be customized for this repository instance.

Parameters:
  `springSecurityContextKey` - the key under which the security context will be stored. Defaults to `SPRING_SECURITY_CONTEXT_KEY`.

### setSecurityContextHolderStrategy

public void setSecurityContextHolderStrategy(org.springframework.security.core.context.SecurityContextHolderStrategy strategy)
Sets the `SecurityContextHolderStrategy` to use. The default action is to use the `SecurityContextHolderStrategy` stored in `SecurityContextHolder`.

Since:
  5.8

### setTrustResolver

public void setTrustResolver(org.springframework.security.authentication.AuthenticationTrustResolver trustResolver)
Sets the `AuthenticationTrustResolver` to be used. The default is `AuthenticationTrustResolverImpl`.

Parameters:
  `trustResolver` - the `AuthenticationTrustResolver` to use. Cannot be null.