Skip to content

LogoutConfigurer#createLogoutFilter sets the SecurityContextHolderStrategy twice #14592

Closed
@lmorocz

Description

@lmorocz

The org.springframework.security.config.annotation.web.configurers.LogoutConfigurer#createLogoutFilter method sets the SecurityContextHolderStrategy of the result LogoutFilter twice since #11061 and commit.

I don't see any particular reason behind this because (as of now) the LogoutRequestMatcher and SecurityContextHolderStrategy are unrelated (although org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer#getSecurityContextHolderStrategy is protected so it could be overridden, but LogoutConfigurer is final so there will be no subclasses).

IMHO one result.setSecurityContextHolderStrategy(getSecurityContextHolderStrategy()); call is (and will be) enough here.

My educated guess is that this is some unfortunate side effect of the great copy-paste function. :)

Metadata

Metadata

Assignees

Labels

in: configAn issue in spring-security-configstatus: duplicateA duplicate of another issuetype: bugA general bug

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions