|
@@ -122,9 +122,11 @@ The {security-api-url}org/springframework/security/web/context/SecurityContextPe
|
|
|
|
|
|
image::{figures}/securitycontextpersistencefilter.png[]
|
|
|
|
|
|
-<1> Before running the rest of the application, `SecurityContextPersistenceFilter` loads the `SecurityContext` from the `SecurityContextRepository` and sets it on the `SecurityContextHolder`.
|
|
|
-<2> Next, the application is ran.
|
|
|
-<3> Finally, if the `SecurityContext` has changed, we save the `SecurityContext` using the `SecurityContextPersistenceRepository`.
|
|
|
+image:{icondir}/number_1.png[] Before running the rest of the application, `SecurityContextPersistenceFilter` loads the `SecurityContext` from the `SecurityContextRepository` and sets it on the `SecurityContextHolder`.
|
|
|
+
|
|
|
+image:{icondir}/number_2.png[] Next, the application is ran.
|
|
|
+
|
|
|
+image:{icondir}/number_3.png[] Finally, if the `SecurityContext` has changed, we save the `SecurityContext` using the `SecurityContextPersistenceRepository`.
|
|
|
This means that when using `SecurityContextPersistenceFilter`, just setting the `SecurityContextHolder` will ensure that the `SecurityContext` is persisted using `SecurityContextRepository`.
|
|
|
|
|
|
In some cases a response is committed and written to the client before the `SecurityContextPersisteneFilter` method completes.
|
|
@@ -141,8 +143,9 @@ The {security-api-url}org/springframework/security/web/context/SecurityContextHo
|
|
|
|
|
|
image::{figures}/securitycontextholderfilter.png[]
|
|
|
|
|
|
-<1> Before running the rest of the application, `SecurityContextHolderFilter` loads the `SecurityContext` from the `SecurityContextRepository` and sets it on the `SecurityContextHolder`.
|
|
|
-<2> Next, the application is ran.
|
|
|
+image:{icondir}/number_1.png[] Before running the rest of the application, `SecurityContextHolderFilter` loads the `SecurityContext` from the `SecurityContextRepository` and sets it on the `SecurityContextHolder`.
|
|
|
+
|
|
|
+image:{icondir}/number_2.png[] Next, the application is ran.
|
|
|
|
|
|
Unlike, xref:servlet/authentication/persistence.adoc#securitycontextpersistencefilter[`SecurityContextPersisteneFilter`], `SecurityContextHolderFilter` only loads the `SecurityContext` it does not save the `SecurityContext`.
|
|
|
This means that when using `SecurityContextHolderFilter`, it is required that the `SecurityContext` is explicitly saved.
|
|
@@ -169,4 +172,4 @@ public SecurityFilterChain filterChain(HttpSecurity http) {
|
|
|
<!-- ... -->
|
|
|
</http>
|
|
|
----
|
|
|
-====
|
|
|
+====
|