clearContext on exception about ixortalk.aws.cognito.jwt.security.filter HOT 6 CLOSED

i can make a pull requests, if you consider is usefull

from ixortalk.aws.cognito.jwt.security.filter.

Can you describe you use-case with the library ? Do you want to have some kind of fallback mechanism in place when the Jwt Authentication fails (and use another authenication mechanism ?)

I think it's a common practice to clear the security context upon an exception in a security filter (ex: BasicAuthenticationFilter does exactly the same, catching the exception and clearing the securitycontext.

But happy to hear about your use case and seeing how we can facilitate it.

from ixortalk.aws.cognito.jwt.security.filter.

"and use another authenication mechanism?" simply YES

we need to use AWS Cognito and a custom sso

i hava another filter that create your JwtAuthentication in same format but using different logic

with this works perfectly
https://github.com/xanscale/ixortalk.aws.cognito.jwt.security.filter/commit/9d74796ba6974de7859cdf3cf87bd9c004089828

instead of clear security context i used

.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)

from ixortalk.aws.cognito.jwt.security.filter.

Is your filter made part of the spring security filter chain ? If so you can run it after the AwsCognitoJwtAuthenticationFilter. The AwsCognitoJwtAuthenticationFilter will clear the security context but your filter can then fill it up.

Would that be an option ?

I did log issue #13 just now to point out that spring can register the filter twice when not providing a custom FilterRegistrationBean to exclude it.

from ixortalk.aws.cognito.jwt.security.filter.

i will try your #13 suggestion, but in this way how set order? can you show me code for registering 2 filter in specific order?

from ixortalk.aws.cognito.jwt.security.filter.

go further on other thread

from ixortalk.aws.cognito.jwt.security.filter.