SEC-776: Http Session created for Anonymous request

[spring-projects-issues]

Corey T(Migrated from SEC-776) said:

I’m using Anonymous Authentication for the public pages on a site I’m developing. If I go to a page that is successful an anonymous authentication token is made and the reset by the AnonymousProcessingFilter so that no HttpSession is created for that request. However, if the page I go to results in an error (like 404 or 500) an HttpSession is created with the anonymous authentication token saved within.

I think that it is because the HttpSessionContextIntegrationFilter wraps the response so that it can try and save the context on sendError/sendRedirect calls, however the AnonymousProcessingFilter isn’t given a chance to remove the anonymous authentication token, the result is that a session is created.

[spring-projects-issues]

Luke Taylor said:

Thanks for the report. We should probably add an AuthenticationTrustResolver to the wrapper (or HttpSCIF) to allow it to determine that the user is anonymous and the context should not be saved.

[spring-projects-issues]

Luke Taylor said:

I’ve added a check for anonymous authentication to HttpSessionContextIntegrationFilter.