What is SecurityContextHolderAwareRequestFilter?

[sutharhemal]

Hi,I am new with the Spring Security Framework.
Can anyone please tell me what is the SecurityContextHolderAwareRequestFilter?
and when can i use this filter?
i have refered many URLs from Google but not getting exatly.

[jbbarquero]

SecurityContextHolderAwareRequestFilter provides the standard servlet API security methods, using a request wrapper which accesses the SecurityContext.

For instance, if you want to ask for the user in this way:

<c:if test="${pageContext['request'].userPrincipal != null}">

You'll need Spring Security to put that information in the Servlet API.

See B.1.2 http namespace to see how can it be configured (since it's optional). Basically use servlet-api-provision.

It'll be placed in the fifth place in Filter Chain. See 8.3 Filter Ordering

[sutharhemal]

Thanx in advance.
Can you please Explain in Detail?

[jbbarquero]

I don't understand your question.

Maybe the best option is to take a look at Spring Security site/ where you can find a lot of documentation (Getting Started, tutorials and so on)

Furthermore, it recommends a book that I found very useful to understand Spring Security: Spring Security book

In fact, there's little detail to explain.

If you find you need in your code calls to the HttpServletRequest interface (something like req.isUserInRole("ADMIN"), req.getAuthentication(), req.getRemoteUser()...)), SecurityContextHolderAwareRequestFilter will allow you to use in your code, because this filter populates the ServletRequest in order you can use the servlet API security methods (the ones shown a little words earlier)

Just a clarification, servlet-api-provision defaults to true, so you don't need to specify it in the tag http from the security namespace.

I mean, you have it configured just with:

    <http auto-config="true" use-expressions="true">
    	<form-login login-processing-url="/resources/j_spring_security_check" login-page="/login" authentication-failure-url="/login?login_error=t"/>
        <logout logout-url="/resources/j_spring_security_logout"/>
        
        <!-- Configure these elements to secure URIs in your application -->
        <intercept-url pattern="/**" access="permitAll" />
    </http>

	<!-- Etc... -->