Process HTTP session data on websocket handshake and load SecurityContext into Subscriptions

[lucatk]

Pull request checklist

• Please read our contributor guide
• Consider creating a discussion on the discussion forum
  first
• Make sure the PR doesn't introduce backward compatibility issues
• Make sure to have sufficient test cases

Pull Request type

• Bugfix
• Feature
• Refactoring (no functional changes, no api changes)
• Build related changes
• Other (please describe):

Changes in this PR

This fixes a bug where we don't receive the correct SecurityContext in subscriptions, because the HTTP session etc. is only available during the handshake, meaning Spring Security logic (annotations, etc.) does not work.
The HttpSessionHandshakeInterceptor handles the extraction of HTTP headers during the handshake and makes it available as attributes on the WebSocketSession.
Then the correct SecurityContext is loaded prior to handling any WebSocket message.

Alternatives considered

• Create own WebSocket controller, but the DgsWebSocketHandler class needs to be open so we can extend it and add the loading of the SecurityContext for ourselves.

[srinivasankavitha]

Thanks for the PR! Are you able to add tests to our existing test suite to verify this functionality?

[berngp]

Approach seems reasonable, thanks for the fix!

[lucatk]

Thanks for merging and releasing this ever so quickly!❤️

[LexanRed]

Thanks for your effort! I am running in the same issues.
Unfortunately, I still get the same problems.

What is the correct way to retrieve the Security Context in a method, called by a subscription?

We use Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
This sometimes works, but not always. I guess there must be a better way.

Any help is very much appreciated 😄

[LexanRed]

Any input on this one? As described in #450, getting the security context fails sometimes. We managed to figure out, it fails when no mutation / query has been sent before. No session exists in this case.
How do you manage to reliably retrieve the security context?

[Feedcube]

Thanks a lot for fixing this issue @lucatk !
How did you manage to intercept the handshake to set the authentication object?
When i override the WebSocketConfigurer in an own class to add the interceptor, the registerWebSocketHandlers gets not called