Skip to main content


This bean is configured as shown below:
<bean id="securityContextPersistenceFilter" class=""/>
This bean has two main tasks and they are very important
  • In a typical web application like Skyphoto the user will login once and then subsequently do several operations or click several links and buttons generating several authenticated requests to the server. Since the user was authenticated once it is important to store the security context somewhere and by some means. Otherwise he/she has to authenticate for each request and will sooner or later never use Skyphoto. In a typical web application you will store an user object in HttpSession and each time a request comes in, the server identifies this session with a session id and you get the user object. It is the responsibility of the server to cache/store and manage these session objects during the lifetime of the session.
“In Spring Security, the responsibility for storing the SecurityContext between requests falls to the SecurityContextPersistenceFilter, which by default stores the context as an HttpSession attribute between HTTP requests. It restores the context to the SecurityContextHolder for each request….”
  • The SecurityContextPersistenceFilter stores the security context in ThreadLocal for the current execution. Hence it is essential to clear this thread local object in a web application as the server uses a pool of thread and chances are that this thread will be reused. If this security context is not cleared there is a high possibility that the set information will be used for request from a different user leading to unpredictable results and possible violation of security.
The SecurityContextPersistenceFilter takes care of clearing the security context object from thread local once the request completes.
This filter MUST be executed BEFORE any authentication processing filter. Authentication processing mechanisms used in those filters expect the SecurityContextHolder to contain a valid SecurityContext by the time they execute.
The task of saving and retrieving the security context is delegated to a separate strategy interface SecurityContextRepository. The interface is shown below:
public interface SecurityContextRepository {
  SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder);
  void saveContext(SecurityContext context, HttpServletRequest request,
         HttpServletResponse response);
“The HttpRequestResponseHolder is simply a container for the incoming request and response objects, allowing the implementation to replace these with wrapper classes. The returned contents will be passed to the filter chain.”
The default implementation of SecurityContextRepository is the HttpSessionSecurityContextRepository class. As the name suggests it stores the security context as an HttpSession attribute.This class has an important attribute - allowSessionCreation  which by default is set to true. Hence this class can create a new session if it needs to for storing security context of an authenticated user. Note that session is only created after authentication is done and contents of security context now has been changed with authenticated user information. If you want to prevent session creation, then set this parameter to false. A sample configuration is shown below.
<bean id="securityContextPersistenceFilter" class=""> <property name='securityContextRepository'>
<bean class=''> <property name='allowSessionCreation' value='false' />


Popular posts from this blog

Why do you need Spring Cloud Config server?

Last month I wrote a primer on concepts around 12 factor app. Before getting into the details of the Spring Cloud Config Server, I must refresh on the principle #3 from the list presented in that post.

3 – ConfigurationStore config in the environments
Configuration information must be separate from the source code. This may seem so obvious, but often we are guilty of leaving critical configuration parameters in the scattered in the code. Instead, applications should have environment specific configuration files. The sensitive information like database password or API key should be stored in these environment configuration files in encrypted format.
 The key takeaways from this postulate for a cloud-native microservices application are:
Do not store configuration as part of the deployable unit (in the case of lead microservice - inside the jar or war if you are still deploying war like the good old days). Instead, store it in an external location and make it easily accessible during run-…

Changing the root web application in Tomcat 6

These days I am very busy developing a large and complex web application, which is nearing its first release. This web based product runs on Tomcat 6 and will be deployed on
But if I deploy my web application on Tomcat 6, I need to specify the context root. Well this is no good, why will the users of this website be willing to remember the context root. What if the context root changes. In other words the users would not be interest in typing the following - to visit this site.
Hence it is necessary that I change the default / root web application of Tomcat and point it to my application. I wanted to try and test this on localhost first. As always I Googled and found a number of posts and none seem to work. I also read the documentation it was helpful in understanding the concepts but was not effective as I could not get it working. Finally after few hours of trial and error one of my colleague Joyeeta Majumdar found the so…

Part 3 - Integrating Tiles, Thymeleaf and Spring MVC 3

In this post I will demonstrate how to integrate Apache Tiles with Thymeleaf. This is very simple. The first step is to include the tiles and thymeleaf-tiles extension dependencies. I will include them in the pom.xml. Note we wil lbe using Tiles 2.2.2Listing 1 - parent/pom.xml --- thymeleaf-tiles and tiles dependencies <!-- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -->
<!-- Tiles -->
<!-- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -->