Description
The org.springframework.security.config.annotation.web.configurers.LogoutConfigurer#createLogoutFilter
method sets the SecurityContextHolderStrategy
of the result LogoutFilter
twice since #11061 and commit.
I don't see any particular reason behind this because (as of now) the LogoutRequestMatcher
and SecurityContextHolderStrategy
are unrelated (although org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer#getSecurityContextHolderStrategy
is protected so it could be overridden, but LogoutConfigurer
is final so there will be no subclasses).
IMHO one result.setSecurityContextHolderStrategy(getSecurityContextHolderStrategy());
call is (and will be) enough here.
My educated guess is that this is some unfortunate side effect of the great copy-paste function. :)