STATELESS is causing SecurityContextHolder.getContext().getAuthentication() always be null. about jwt-spring-security-demo HOT 4 CLOSED

@bfwg It is not always null, only in the case, that there is no authorization request header. The problem is, that the filter now filters every request and many times there is no authorization header. It would be better if the filter only filters requests that should be secured based on the security configuration.

from jwt-spring-security-demo.

@bfwg & @szerhusenBC I have a question, assuming doFilterInternal method is setting Authentication with every valid request (by using SecurityContextHolder.getContext().setAuthentication(authentication);)
If there are multiple requests will there be a confliction? For example, if I am using the authentication for Authorization (@PreAuthorize("@validator.isAuthorised(true,#request,authentication)")) on rest end points to determine the access will it be safe?

from jwt-spring-security-demo.

Hi @szerhusenBC , you are correct. This is how I did to filter base on response path: https://github.com/bfwg/springboot-jwt-starter/blob/master/src/main/java/com/bfwg/config/WebSecurityConfig.java#L104
I imagine there must be a more elegant way to handle this. Please let me know what you think.

from jwt-spring-security-demo.

@bfwg While migrating to Spring Boot 2 I did some fixes and optimizations. It seems that the filter now only is invoked for the secured URLs. So I'm closing this ticket now.

from jwt-spring-security-demo.