SEC-2353: ConcurrentModificationException in AuthorityUtils

[spring-projects-issues]

Manish (Migrated from SEC-2353) said:

We have been using Spring Security in our application for the last 2 years. We use Spring Security annotations in the web and business logic layers to secure access to various operations.

A few weeks back we upgraded to Spring Security 3.1.4.RELEASE. After the upgrade we frequently run into an error similar to the one shown below:

org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.util.ConcurrentModificationException
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:948)
    at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:827)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:621)
    at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:812)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:118)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:84)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:103)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilter(BasicAuthenticationFilter.java:150)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:183)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:343)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:260)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
    at org.springframework.orm.jpa.support.OpenEntityManagerInViewFilter.doFilterInternal(OpenEntityManagerInViewFilter.java:180)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
    at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:929)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1002)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:585)
    at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:312)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
    at java.lang.Thread.run(Thread.java:724)
Caused by: java.util.ConcurrentModificationException
    at java.util.ArrayList$Itr.checkForComodification(ArrayList.java:819)
    at java.util.ArrayList$Itr.next(ArrayList.java:791)
    at org.springframework.security.core.authority.AuthorityUtils.authorityListToSet(AuthorityUtils.java:41)
    at org.springframework.security.access.expression.SecurityExpressionRoot.getAuthoritySet(SecurityExpressionRoot.java:121)
    at org.springframework.security.access.expression.SecurityExpressionRoot.hasRole(SecurityExpressionRoot.java:57)
    at org.springframework.security.access.expression.SecurityExpressionRoot.hasAuthority(SecurityExpressionRoot.java:49)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:606)
    at org.springframework.expression.spel.support.ReflectiveMethodExecutor.execute(ReflectiveMethodExecutor.java:69)
    at org.springframework.expression.spel.ast.MethodReference.getValueInternal(MethodReference.java:144)
    at org.springframework.expression.spel.ast.SpelNodeImpl.getValue(SpelNodeImpl.java:134)
    at org.springframework.expression.spel.ast.OpAnd.getBooleanValue(OpAnd.java:51)
    at org.springframework.expression.spel.ast.OpAnd.getValueInternal(OpAnd.java:46)
    at org.springframework.expression.spel.ast.SpelNodeImpl.getTypedValue(SpelNodeImpl.java:102)
    at org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:98)
    at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:11)
    at org.springframework.security.access.expression.method.ExpressionBasedPreInvocationAdvice.before(ExpressionBasedPreInvocationAdvice.java:41)
    at org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter.vote(PreInvocationAuthorizationAdviceVoter.java:54)
    at org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter.vote(PreInvocationAuthorizationAdviceVoter.java:24)
    at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:62)
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:206)
    at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:60)
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
    at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:91)
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
    at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:631)
    at org.example.service.SomeService$$EnhancerByCGLIB$$2fb6ed81.getSummary(<generated>)
    at org.example.web.SomeController.summary(SomeController.java:88)
    at org.example.web.SomeController$$FastClassByCGLIB$$877d38e2.invoke(<generated>)
    at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204)
    at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:698)
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)
    at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:64)
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
    at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:631)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:606)
    at org.springframework.web.method.support.InvocableHandlerMethod.invoke(InvocableHandlerMethod.java:219)
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:132)
    at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:104)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandleMethod(RequestMappingHandlerAdapter.java:745)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:686)
    at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:80)
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:925)
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:856)
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:936)
    ... 54 more

If the user requests the same resource again, the error goes away. This happens only when a non-logged-in user requests a secure resource, is redirected to the login page, logs in correctly and is then redirected back to the original resource.

In case it helps, here is the relevant Java code:

@Controller
@PreAuthorize("authentication.name == 'Administrator'")
@RequestMapping("/control/panel")
public class SomeController
{
    @Autowired
    SomeService service;

    @RequestMapping("summary")
    public String summary(final Model model)
    {
        model.addAttribute(summary, this.service.getSummary());

        return "control/dashboard/summary";
    }
}

@Service
public class SomeService
{
    @PreAuthorize("authentication.name == 'Administrator'")
    public DashboardSummary getSummary()
    {
        ...
    }
}

[spring-projects-issues]

Rob Winch said:

Thanks for the report. How are you authenticating to the application? Are you modifying the authorities anywhere? Can you post your security configuration? Also if you have any custom code around authentication can you post it? In particular interest would be how you are creating the Authentication object.

[spring-projects-issues]

Manish said:

Spring Security configuration (copied verbatim):

<beans>
    <bean class="org.example.web.security.WebAuthenticationProvider" id="authenticationProvider" />

    <security:authentication-manager erase-credentials="false">
        <security:authentication-provider ref="authenticationProvider" />
    </security:authentication-manager>

    <security:global-method-security jsr250-annotations="enabled" pre-post-annotations="enabled" secured-annotations="enabled" />

    <security:http pattern="/css/**" security="none" />
    <security:http pattern="/images/**" security="none" />
    <security:http pattern="/script/**" security="none" />

    <security:http access-denied-page="/error/403" auto-config="true" use-expressions="true">
        <security:form-login always-use-default-target="true" authentication-failure-url="/login/failure?status=error" default-target-url="/"
            login-page="/login" login-processing-url="/login/submit" password-parameter="password" username-parameter="emailAddress" />
        <security:logout delete-cookies="true" invalidate-session="true" logout-success-url="/logout/continue" logout-url="/logout" />
    </security:http>
</beans>

Relevant Java code (copied verbatim):

/**
 * An implementation of Spring Security {@link AuthenticationProvider} that uses
 * an email address and password for user authentication.
 */
public class WebAuthenticationProvider implements AuthenticationProvider
{
    @Autowired
    UserService userService;

    /**
     * Processes login information and attempts to authenticate the user.
     */
    @Override
    public Authentication authenticate(final Authentication authentication) throws AuthenticationException
    {
        final AuthenticationResponse authenticationResponse = this.userService.authenticate(new AuthenticationRequest(authentication.getName(), (String) authentication
                .getCredentials()));

        if (authenticationResponse.getStatus() == APIResponseStatus.OK)
        {
            SecurityContextHolder.getContext().setAuthentication(new AuthenticationToken(authenticationResponse.getUserSummary()));

            return SecurityContextHolder.getContext().getAuthentication();
        }

        throw new AuthenticationServiceException(String.format("The email address [%s] could not be authenticated.", authentication.getName()));
    }

    /**
     * Indicates that authentication using an email address and password is
     * supported.
     */
    @Override
    public boolean supports(final Class<?> authentication)
    {
        return authentication != null && authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
}

And finally, the authentication token:

public final class AuthenticationToken implements Authentication, CredentialsContainer
{
    private static final long                                     serialVersionUID = 1L;

    private final List<SimpleGrantedAuthority>                    authorities;
    private final String                                          principal;

    /**
     * Sets the user's identity.
     *
     * @param user A {@link UserSummaryResponse}.
     */
    public AuthenticationToken(final UserSummaryResponse user)
    {
        this.authorities = Collections.unmodifiableList(user.getAuthorities());
        this.principal = user.getName();
    }

    /**
     * @see org.springframework.security.core.CredentialsContainer#eraseCredentials()
     */
    @Override
    public void eraseCredentials()
    {
        // Nothing specific to be done.
    }

    /**
     * @see org.springframework.security.core.Authentication#getAuthorities()
     */
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities()
    {
        return this.authorities;
    }

    /**
     * @see org.springframework.security.core.Authentication#getCredentials()
     */
    @Override
    public Object getCredentials()
    {
        return this.principal;
    }

    /**
     * @see org.springframework.security.core.Authentication#getDetails()
     */
    @Override
    public Object getDetails()
    {
        return this.principal;
    }

    /**
     * @see java.security.Principal#getName()
     */
    @Override
    public String getName()
    {
        return this.principal;
    }

    /**
     * @see org.springframework.security.core.Authentication#getPrincipal()
     */
    @Override
    public Object getPrincipal()
    {
        return this.principal;
    }

    /**
     * @see org.springframework.security.core.Authentication#isAuthenticated()
     */
    @Override
    public boolean isAuthenticated()
    {
        return true;
    }

    /**
     * @see org.springframework.security.core.Authentication#setAuthenticated(boolean)
     */
    @Override
    public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException
    {
        // Nothing specific to be done.
    }
}

[spring-projects-issues]

Rob Winch said:

Is there a place that you are adding authorities to the existing Authentication or UserSummaryResponse? This is the only thing I can think of that would cause this error. Can you try changing your AuthenticationToken to use the following:

    public AuthenticationToken(final UserSummaryResponse user)
    {
        this.authorities = Collections.unmodifiableList(new ArrayList<SimpleGrantedAuthority>(user.getAuthorities()));
        this.principal = user.getName();
    }

[spring-projects-issues]

Manish said:

Hi Rob

The authorities are not changed after being fetched from the service.

I have changed the code as per your suggestion. I will report back in a few days time on how the application holds up.

Thanks for your review and help.

[spring-projects-issues]

Rob Winch said:

Any news?

[spring-projects-issues]

Manish said:

Ok, it has been close to a month and we haven't seen the error again on any environment. I guess we can safely close this.

[spring-projects-issues]

Rob Winch said:

Thanks for the response. Resolving per previous comment