Package org.springframework.security.web.context

Interface SecurityContextRepository

All Known Implementing Classes:
HttpSessionSecurityContextRepository, NullSecurityContextRepository, RequestAttributeSecurityContextRepository
public interface SecurityContextRepository
Strategy used for persisting a SecurityContext between requests.

Used by SecurityContextPersistenceFilter to obtain the context which should be used for the current thread of execution and to store the context once it has been removed from thread-local storage and the request has completed.

The persistence mechanism used will depend on the implementation, but most commonly the HttpSession will be used to store the context.

Since:
3.0
See Also:

  • Method Summary

    Modifier and Type
    Method
    Description
    boolean
    containsContext(jakarta.servlet.http.HttpServletRequest request)
    Allows the repository to be queried as to whether it contains a security context for the current request.
    default Supplier<SecurityContext>
    loadContext(jakarta.servlet.http.HttpServletRequest request)
    Obtains the security context for the supplied request.
    SecurityContext
    loadContext(HttpRequestResponseHolder requestResponseHolder)
    Deprecated.
    Use loadContext(HttpServletRequest) instead.
    void
    saveContext(SecurityContext context, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
    Stores the security context on completion of a request.

  • Method Details

    • loadContext

      @Deprecated SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder)
      Deprecated.
      Use loadContext(HttpServletRequest) instead.
      Obtains the security context for the supplied request. For an unauthenticated user, an empty context implementation should be returned. This method should not return null.

      The use of the HttpRequestResponseHolder parameter allows implementations to return wrapped versions of the request or response (or both), allowing them to access implementation-specific state for the request. The values obtained from the holder will be passed on to the filter chain and also to the saveContext method when it is finally called to allow implicit saves of the SecurityContext. Implementations may wish to return a subclass of SaveContextOnUpdateOrErrorResponseWrapper as the response object, which guarantees that the context is persisted when an error or redirect occurs. Implementations may allow passing in the original request response to allow explicit saves.

      Parameters:
      requestResponseHolder - holder for the current request and response for which the context should be loaded.
      Returns:
      The security context which should be used for the current request, never null.

    • loadContext

      default Supplier<SecurityContext> loadContext(jakarta.servlet.http.HttpServletRequest request)
      Obtains the security context for the supplied request. For an unauthenticated user, an empty context implementation should be returned. This method should not return null.
      Parameters:
      request - the HttpServletRequest to load the SecurityContext from
      Returns:
      a Supplier that returns the SecurityContext which cannot be null.
      Since:
      5.7

    • saveContext

      void saveContext(SecurityContext context, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
      Stores the security context on completion of a request.
      Parameters:
      context - the non-null context which was obtained from the holder.
      request -
      response -

    • containsContext

      boolean containsContext(jakarta.servlet.http.HttpServletRequest request)
      Allows the repository to be queried as to whether it contains a security context for the current request.
      Parameters:
      request - the current request
      Returns:
      true if a context is found for the request, false otherwise