return;
}
HttpSession httpSession = safeGetSession(request, forceEagerSessionCreation);
boolean httpSessionExistedAtStartOfRequest = httpSession != null;
SecurityContext contextBeforeChainExecution = readSecurityContextFromSession(httpSession);
// Make the HttpSession null, as we don't want to keep a reference to it
// lying
// around in case chain.doFilter() invalidates it.
httpSession = null;
if (contextBeforeChainExecution == null) {
contextBeforeChainExecution = generateNewContext();
logger.debug("New SecurityContext instance will be associated with SecurityContextHolder");
} else {
logger.debug("Obtained a valid SecurityContext from Beangle_SECURITY_CONTEXT to "
+ "associate with SecurityContextHolder: '{}'", contextBeforeChainExecution);
}
int contextHashBeforeChainExecution = contextBeforeChainExecution.hashCode();
request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
// Create a wrapper that will eagerly update the session with the
// security context
// if anything in the chain does a sendError() or sendRedirect().
// See SEC-398
OnRedirectUpdateSessionResponseWrapper responseWrapper = new OnRedirectUpdateSessionResponseWrapper(
response, request, httpSessionExistedAtStartOfRequest, contextHashBeforeChainExecution);
// Proceed with chain
try {
// This is the only place in this class where
// SecurityContextHolder.setContext() is called
SecurityContextHolder.setContext(contextBeforeChainExecution);
chain.doFilter(request, responseWrapper);
} finally {
// This is the only place in this class where
// SecurityContextHolder.getContext() is called
SecurityContext contextAfterChainExecution = SecurityContextHolder.getContext();
// Crucial removal of SecurityContextHolder contents - do this
// before anything else.
SecurityContextHolder.clearContext();