Session is needlessly created by HttpSecurityWrapper::getUserPrincipal

XMLWordPrintable

    • Type: Bug
    • Resolution: Fixed
    • Priority: Low
    • 0.8
    • Affects Version/s: 0.7.23
    • None

      In HttpSecurityWrapper::getUserPrincipal session creation is forced when trying to retrieve the servlet context

      public Principal getUserPrincipal()
{
        if (securityConfig == null)
        {
            securityConfig = (SecurityConfig) request.getSession().getServletContext().getAttribute(SecurityConfig.STORAGE_KEY);
        }

        Principal user = securityConfig.getAuthenticator().getUser(request);
        return user;
}

      This can interfere with the SecurityFilter which uses the fact that a session exists to attempt to find a logged in user. It is also a generally bad practice to create a session needlessly.

            Assignee:
            Christopher Owen [Atlassian]
            Reporter:
            Christopher Owen [Atlassian]
            Votes:
            1 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: