Spring Boot authentication not available from error page - spring-boot

Question

Depending on whether the user is logged in, I want to display an element on an error page e.g.
<div sec:authorize="isAuthenticated()">
Logged in
</div>
The problem is, however is that the current Authentication Principal is being cleared for some reason. I thought it had something to do with the No Auth for You bug, so I added
security.filter-dispatcher-types: ASYNC, FORWARD, INCLUDE, REQUEST, ERROR
However still the problem persists. I loaded up both projects and debug-logged spring security. With the No Auth For You project I'm getting:
SecurityContextHolder now cleared, as request processing completed
Cleared thread-bound request context: org.apache.catalina.connector.RequestFacade#76d66409
Processing ErrorPage[errorCode=0, location=/error]
/error at position 1 of 12 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
/error at position 2 of 12 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
Obtained a valid SecurityContext from SPRING_SECURITY_CONTEXT: 'org.springframework.security.core.context.SecurityContextImp.....
Which gives the correct security context.
With my project I'm getting
SecurityContextHolder now cleared, as request processing completed
Cleared thread-bound request context: org.springframework.session.web.http.SessionRepositoryFilter$SessionRepositoryRequestWrapper#380b96d
Processing ErrorPage[errorCode=0, location=/error]
/error at position 1 of 12 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
/error at position 2 of 12 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
No HttpSession currently exists
No SecurityContext was available from the HttpSession: null. A new one will be created.
So the issue seems to be "No HttpSession currently exists". I am using Redis Sessions, if that makes a difference. However I don't know really where to go from here, when it comes to debugging.
I am using the GlobalDefaultException handler code from the Spring blog, if that makes any difference. However I actually ported this handler to the No Auth For You project, so I don't believe it is that.
If I leave this error page and view any other page, then I am still logged in.
Update
I removed Redis and it could find the session. Maybe it is something to do with Tomcat and Redis?
Update 2018
I have looked at this again, and I think it has something to do with the GlobalExceptionHandler (as mentioned before taken from Spring's blog).
"If you want to have a default handler for any exception, there is a slight wrinkle. You need to ensure annotated exceptions are handled by the framework."
#ControllerAdvice
public class GlobalExceptionHandler
{
#ExceptionHandler({Exception.class})
#ResponseStatus(value = INTERNAL_SERVER_ERROR)
public String exception(
HttpServletRequest request,
Exception e,
Model model
) throws Exception
{
// other logging things here
if (AnnotationUtils.findAnnotation(e.getClass(), ResponseStatus.class) != null)
{
// template that renders this can't access the SecurityContext
throw e;
}
// this template can access the SecurityContext
return "error";
}
}
The caught exception is able to access the SecurityContext, however the re-thrown exceptions (handled by Spring) can't access the SecurityContext.
Remember that both templates can access the SecurityContext, when Redis is not being used. I looked at the documentation for Spring Session and it says
"...[t]his creates a Spring Bean with the name of springSessionRepositoryFilter that implements Filter. The filter is what is in charge of replacing the HttpSession implementation to be backed by Spring Session."
So maybe this bean isn't being used for some reason?
Under Spring Boot 2.0.0.M7 it works, so I wonder what was changed
DEBUG 3767 --- [0.1-8080-exec-1] o.s.security.web.FilterChainProxy : /errorTest/notFound at position 2 of 13 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
DEBUG 3767 --- [0.1-8080-exec-1] o.s.d.redis.core.RedisConnectionUtils : Opening RedisConnection
DEBUG 3767 --- [0.1-8080-exec-1] io.lettuce.core.RedisChannelHandler : dispatching command AsyncCommand [type=HGETALL, output=MapOutput [output=null, error='null'], commandType=io.lettuce.core.protocol.Command]
[SNIP REDIS]
DEBUG 3767 --- [0.1-8080-exec-1] o.s.d.redis.core.RedisConnectionUtils : Closing Redis Connection
DEBUG 3767 --- [0.1-8080-exec-1] w.c.HttpSessionSecurityContextRepository : Obtained a valid SecurityContext from SPRING_SECURITY_CONTEXT: 'org.springframework.security.core.context.SecurityContextImpl#936f4f11: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken
I think it is related to the following issue:
https://github.com/spring-projects/spring-boot/issues/5737
I think it makes sense to change SecurityFilterAutoConfiguration to use the ERROR dispatch type by default. The ERROR dispatch type is also the default of Spring Security's Servlet Java Config.
The reason the ERROR dispatch type makes sense for Spring Security is many times navigation is based on the permissions of the current user. Without Spring Security being populated, the error page may not have
meaningful navigation.