SecurityContextHolder.getContext().getAuthentication() is null for Ajax call - ajax

Question

I have a situation where we have two separate home pages for signed in and non-signed in users. But we are trying to cache these pages using cloudfront. One part of the home page is dynamic and we are trying to set this using an Ajax/jquery calling restful service and setting the output values in template javascript. This javascript is executed on load of signed in JSP.
I believe SecurityContextHolder.getContext().setAuthentication() is being called after logging in.
In Restful webservice called by Ajax I am trying to get Loggedin User using
SecurityContextHolder.getContext().getAuthentication().getPrincipal(). But getAuthentication() is returning null.
My web.xml is as below
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
WEB-INF/classes/persistence-context.xml
WEB-INF/xyz-servlet.xml
WEB-INF/classes/environment-context.xml
WEB-INF/classes/transactional-context.xml
WEB-INF/classes/spring-security-context.xml
WEB-INF/classes/services-context.xml
WEB-INF/classes/aop-context.xml
</param-value>
</context-param>
<!-- Spring Security Filter -->
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>FORWARD</dispatcher>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
In spring-security-context.xml I have below values
<http use-expressions="true" auto-config="false" create-session="never" entry-point-ref="authenticationProcessingFilterEntryPoint">
<access-denied-handler ref="exceptionResolver" />
<intercept-url pattern="/xyz/myaccount/**" access="hasRole('FRONT_END_USER')" />
<intercept-url pattern="/xyz/form-clickref*" access="hasRole('FRONT_END_USER')" />
<intercept-url pattern="/**" filters="none" />
<form-login login-page="/xyz/login" login-processing-url="/xyz/j_spring_security_check"
authentication-failure-handler-ref="xyzAuthenticationFailureHandler"
authentication-success-handler-ref="simpleUrlAuthenticationSuccessHandler" />
<logout logout-url="/xyz/logout" invalidate-session="true" success-handler-ref="logoutSuccessHandler" />
<remember-me services-ref="rememberMeServices" key="fe2c667b-d39e-4277-ba66-709ca0bee944" />
<anonymous enabled="false" />
<request-cache ref="nullRequestCache" />
<session-management session-fixation-protection="none" />
</http>

Answer 1

I guess, the application lost track of the users http session in your AJAX Requests.
Normally there are two (three) ways to track the session of an user:
using JSessionID a url query parameter
using a cookie that contains the JSessionID
(mixed mode: the sever decides which of the two above techniques to use)
I guess that your AJAX request is not sending the Cookie nor the JSessionId request parameter.
To understand the problem, I would use some tool/Firefoxplugin (FireBug, Http Live Headers, ...) to have a look at the REQUESTs sended to the server. I would check the "normal" requests, and have a look whether I can find the JSessionID (url query paramter, or session). Then I would have a look at the AJAX requests, and would look for the same information.
If there is a JSessionId in the normal requests, but not in the AJAX requests, then my guess is right. Then all you need to do, is to this information to the AJAX requests too. good luck