Uploaded image for project: 'atlassian-seraph'
  1. atlassian-seraph
  2. SER-92

Session is needlessly created by HttpSecurityWrapper::getUserPrincipal

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Low Low
    • 0.8
    • 0.7.23
    • None
    • true

      In HttpSecurityWrapper::getUserPrincipal session creation is forced when trying to retrieve the servlet context

      public Principal getUserPrincipal()
{
        if (securityConfig == null)
        {
            securityConfig = (SecurityConfig) request.getSession().getServletContext().getAttribute(SecurityConfig.STORAGE_KEY);
        }

        Principal user = securityConfig.getAuthenticator().getUser(request);
        return user;
}

      This can interfere with the SecurityFilter which uses the fact that a session exists to attempt to find a logged in user. It is also a generally bad practice to create a session needlessly.

              christopher.owen@atlassian.com Christopher Owen [Atlassian]
              christopher.owen@atlassian.com Christopher Owen [Atlassian]
              Votes:
              1 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved:
                17 years, 24 weeks, 5 days ago