Browse Source

Document Saved Requests Migration

Closes gh-12089
Rob Winch 2 years ago
parent
commit
24cc7ff178
1 changed files with 14 additions and 0 deletions
  1. 14 0
      docs/modules/ROOT/pages/migration.adoc

+ 14 - 0
docs/modules/ROOT/pages/migration.adoc

@@ -6,6 +6,20 @@ Use 5.8 and the steps below to minimize changes when updating to 6.0.
 
 == Servlet
 
+[[requestcache-query-optimization]]
+=== Optimize Querying of `RequestCache`
+
+In Spring Security 5, the default behavior is to query the xref:servlet/architecture.adoc#savedrequests[saved request] on every request.
+This means that in a typical setup, that in order to use the xref:servlet/architecture.adoc#requestcache[`RequestCache`] the `HttpSession` is queried on every request.
+
+In Spring Security 6, the default is that `RequestCache` will only be queried for a cached request if the HTTP parameter `continue` is defined.
+This allows Spring Security to avoid unnecessarily reading the `HttpSession` with the `RequestCache`.
+
+In Spring Security 5 the default is to use `HttpSessionRequestCache` which will be queried for a cached request on every request.
+If you are not overriding the defaults (i.e. using `NullRequestCache`), then the following configuration can be used to explicitly opt into the Spring Security 6 behavior in Spring Security 5.8:
+
+include::partial$servlet/architecture/request-cache-continue.adoc[]
+
 === Use `AuthorizationManager` for Method Security
 
 xref:servlet/authorization/method-security.adoc[Method Security] has been xref:servlet/authorization/method-security.adoc#jc-enable-method-security[simplified] through {security-api-url}org/springframework/security/authorization/AuthorizationManager.html[the `AuthorizationManager` API] and direct use of Spring AOP.