How to properly set SecurityContextRepository for a custom UsernamePasswordAuthenticationFilter in Spring Security 6? - spring

Question

Since Spring Security 6.0 an explicit saving of the SecurityContextRepository is required:
https://docs.spring.io/spring-security/reference/migration/servlet/session-management.html#_require_explicit_saving_of_securitycontextrepository
This means that if a custom UsernamePasswordAuthenticationFilter is used, a SecurityContextRepository must be provided to being able to persist the SecurityContext, like this:
#Component
public class InternalUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
#PostConstruct
private void setup() {
super.setSecurityContextRepository(
new DelegatingSecurityContextRepository(
new RequestAttributeSecurityContextRepository(),
new HttpSessionSecurityContextRepository()));
}
//...
}
It seems to be sufficient to specify the SecurityContextRepository only once in the AuthenticationFilter, although #Max in the example here sets the repository in the SecurityFilterChain as well.
I have tested both variants and it doesn't seem to matter if a SecurityContextRepository is specified in the FilterChain or not. It also doesn't seem to matter if we use a bean or create new repositories for both AuthenticationFilter and FilterChain like this:
#Configuration
#EnableWebSecurity
#EnableMethodSecurity(securedEnabled = true)
public class WebSecurityConfig {
#Bean
public SecurityFilterChain mvcFilterChain(HttpSecurity http) throws Exception {
return http
.authorizeHttpRequests(authorize -> authorize
.shouldFilterAllDispatcherTypes(true)
.dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll()
.requestMatchers("/", "/login/**").permitAll()
.anyRequest().authenticated())
.addFilterAt(internalUsernamePasswordAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
.securityContext(securityContext -> securityContext
.securityContextRepository(
new DelegatingSecurityContextRepository(
new RequestAttributeSecurityContextRepository(),
new HttpSessionSecurityContextRepository()
)))
//...
}
}
This would indicate that only the repository of the AuthenticationFilter is used and the repository of the FilterChain is ignored.
My assumption would therefore be that creating the SecurityContextRepository in the AuthenticationFilter would be sufficient.
So my questions are:
Do I see that right?
Or should I rather define a bean?
And is there any reason to set this bean in the SecurityFilterChain as well?
Many thanks for any help for clarification