SecurityContextPersistenceFilter

Class Overview

Populates the SecurityContextHolder with information obtained from the configured SecurityContextRepository prior to the request and stores it back in the repository once the request has completed and clearing the context holder. By default it uses an HttpSessionSecurityContextRepository. See this class for information HttpSession related configuration options.

This filter will only execute once per request, to resolve servlet container (specifically Weblogic) incompatibilities.

This filter MUST be executed BEFORE any authentication processing mechanisms. Authentication processing mechanisms (e.g. BASIC, CAS processing filters etc) expect the SecurityContextHolder to contain a valid SecurityContext by the time they execute.

This is essentially a refactoring of the old HttpSessionContextIntegrationFilter to delegate the storage issues to a separate strategy, allowing for more customization in the way the security context is maintained between requests.

The forceEagerSessionCreation property can be used to ensure that a session is always available before the filter chain executes (the default is false, as this is resource intensive and not recommended).

Summary

[Expand] Inherited Fields
From class org.springframework.web.filter.GenericFilterBean protected final Log logger

[Expand] Inherited Methods
From class org.springframework.web.filter.GenericFilterBean final void addRequiredProperty(String arg0) void afterPropertiesSet() void destroy() final FilterConfig getFilterConfig() final String getFilterName() final ServletContext getServletContext() final void init(FilterConfig arg0) void initBeanWrapper(BeanWrapper arg0) void initFilterBean() final void setBeanName(String arg0) final void setFilterConfig(FilterConfig arg0) final void setServletContext(ServletContext arg0)
From class java.lang.Object Object clone() boolean equals(Object arg0) void finalize() final Class<?> getClass() int hashCode() final void notify() final void notifyAll() String toString() final void wait() final void wait(long arg0, int arg1) final void wait(long arg0)
From interface javax.servlet.Filter abstract void destroy() abstract void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2) abstract void init(FilterConfig arg0)
From interface org.springframework.beans.factory.BeanNameAware abstract void setBeanName(String arg0)
From interface org.springframework.beans.factory.DisposableBean abstract void destroy()
From interface org.springframework.beans.factory.InitializingBean abstract void afterPropertiesSet()
From interface org.springframework.web.context.ServletContextAware abstract void setServletContext(ServletContext arg0)