Elide with Spring Boot Security 3+ about elide

[white3km]

Not sure of your exact setup but I spend some time migrating to latest Spring Boot/ Security for Elide 7 and I kept getting flaky results with authentication. The issue was the security context wasn't really being persisted per request all the way through. Basically I could see the context get populated then later if the filter chain was run again for another dispatch type it wasn't populated. I think with the upgrade to a new Spring Security they changed the default behavior.

My setup (I use a custom filter instead of vanilla jwt)

    http
          .cors(AbstractHttpConfigurer::disable)
          .csrf(AbstractHttpConfigurer::disable)
          .formLogin(AbstractHttpConfigurer::disable)
          .httpBasic(AbstractHttpConfigurer::disable)
          .anonymous(AbstractHttpConfigurer::disable)
          .logout(AbstractHttpConfigurer::disable)
          .addFilterBefore(
              new CustomAuthFilter(apiUserDetailsService),
              RequestHeaderAuthenticationFilter.class)
          .authorizeHttpRequests(
              (authorize) ->
                  authorize
                      .requestMatchers("/foo/**")
                      .hasAnyRole("ADMIN")
                      .anyRequest()
                      .authenticated())
             .sessionManagement(
              config -> config.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
          // Spring Security 6, calls for all dispatch types
          // https://docs.spring.io/spring-security/reference/servlet/authentication/persistence.html#requestattributesecuritycontextrepository
          .securityContext(
              (securityContext) ->
                  securityContext.securityContextRepository(
                      new RequestAttributeSecurityContextRepository()));

In case it's not clear, this is the important part (https://docs.spring.io/spring-security/reference/servlet/authentication/persistence.html#requestattributesecuritycontextrepository):

.securityContext(
              (securityContext) ->
                  securityContext.securityContextRepository(
                      new RequestAttributeSecurityContextRepository()))

Hope this helps!

[StetsenkoAndrew]

Thanks, it helped a lot! All works now!

[StetsenkoAndrew]

Thanks again @white3km