Describe the bug
After upgrade to spring boot 3.0.0-M5, TestingAuthenticationToken and UsernamePasswordAuthenticationToken not work as the same as spring boot 2.7.3
To Reproduce
- run the sample
- goto http://127.0.0.1:8080/login
you will see
mikuon page. - goto http://127.0.0.1:8080/who
you will see
anonymousUseron page
Expected behavior
step 3: see miku on page
Sample the sample is really simple, just one class.
BTW. If I change build.gradle file id 'org.springframework.boot' version '3.0.0-M5' to org.springframework.boot' version '2.7.3, it works as expect.
repo: https://github.com/oldshensheep/shiny-octo-memory
@Configuration
@RestController
public class Yes {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.csrf().disable()
.authorizeHttpRequests((authz) -> authz
.antMatchers("/**").permitAll()
)
.formLogin().disable();
return http.build();
}
@GetMapping("/who")
public String getName() {
return SecurityContextHolder.getContext().getAuthentication().getName();
}
@GetMapping("/login")
public String login() {
var context = SecurityContextHolder.createEmptyContext();
var authentication =
new TestingAuthenticationToken("miku", "password", "ROLE_USER");
context.setAuthentication(authentication);
SecurityContextHolder.setContext(context);
return SecurityContextHolder.getContext().getAuthentication().getName();
}
}
Comment From: marcusdacoregio
Hi @oldshensheep, you are probably stepping into one of the default changes in 6.0, see #11762 and https://github.com/spring-projects/spring-security/issues/9635.
In order to achieve the same behavior you can either call your SecurityContextRepository#saveContext method or change your security configuration to:
@Configuration
@RestController
public class Yes {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.csrf().disable()
.authorizeHttpRequests((authz) -> authz
.antMatchers("/**").permitAll()
)
.securityContext((context) -> context
.requireExplicitSave(false)
)
.formLogin().disable();
return http.build();
}
// ...
}
I'll go ahead and close this as it is behaving as expected.