We should allow configuring SecurityContextRepository on BasicAuthenticationFilter so that users do not need to rely on SecurityContextPersistenceFitler. Users that want BasicAuthenticationFilter to use a custom repository right now can do this:

http
    .httpBasic(b -> b.addObjectPostProcessor(new ObjectPostProcessor<BasicAuthenticationFilter>() {
            @Override
            public <O extends BasicAuthenticationFilter> O postProcess(O filter) {
                filter.setSecurityContextRepository(new HttpSessionSecurityContextRepository());
                return filter;
            }
        }));

However, it should be easier to configure with an explicit option.

Comment From: evgeniycheban

Hi, @rwinch @jzheaux I'd like to work on it.

Comment From: evgeniycheban

Hi, @rwinch @jzheaux I've created a PR that adds a new method securityContextRepository(SecurityContextRepository securityContextRepository) that can be used to customize it.