{"action":"opened","issue":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/4047","repository_url":"https://api.github.com/repos/spring-projects/spring-security","labels_url":"https://api.github.com/repos/spring-projects/spring-security/issues/4047/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-security/issues/4047/comments","events_url":"https://api.github.com/repos/spring-projects/spring-security/issues/4047/events","html_url":"https://github.com/spring-projects/spring-security/issues/4047","id":173986521,"number":4047,"title":"the securityContext will be lost in jsp page when use the spring async controller.","user":{"login":"wayshall","id":965315,"avatar_url":"https://avatars.githubusercontent.com/u/965315?v=3","gravatar_id":"","url":"https://api.github.com/users/wayshall","html_url":"https://github.com/wayshall","followers_url":"https://api.github.com/users/wayshall/followers","following_url":"https://api.github.com/users/wayshall/following{/other_user}","gists_url":"https://api.github.com/users/wayshall/gists{/gist_id}","starred_url":"https://api.github.com/users/wayshall/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wayshall/subscriptions","organizations_url":"https://api.github.com/users/wayshall/orgs","repos_url":"https://api.github.com/users/wayshall/repos","events_url":"https://api.github.com/users/wayshall/events{/privacy}","received_events_url":"https://api.github.com/users/wayshall/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-30T10:42:18Z","updated_at":"2016-08-30T10:42:18Z","closed_at":null,"body":"### Summary\r\nspring security: 4.1.2.RELEASE\r\n\r\nthe securityContext will be lost in jsp page when use the spring async controller with callable dispatcher result, and the authorize tag will not work.\r\n\r\n### Actual Behavior\r\n1. in a spring controller method, return a Callable<String> type to dispatch to a jsp page.\r\n`\r\npublic Callable<String> list() {\r\n\r\n        return () -> {\r\n            //doSomething\r\n            return \"jsppage\";\r\n        };\r\n    }\r\n`\r\n2. in jsppage, use the authorize tag\r\n<security:authorize access=\"hasAuthority('code')\">\r\ntest\r\n</security:authorize>\r\nthe 'test' will not be show although I login with a user which has the 'code' authority.\r\n\r\n3. in fact, the below code in the AbstractAuthorizeTag#authorizeUsingAccessExpression that want to obtain the authentication will return null, because the security context has been clean in SecurityContextPersistenceFilter.\r\n`if (SecurityContextHolder.getContext().getAuthentication() == null) {\r\n\treturn false;\r\n}\r\n`\r\n4. The reason of this issue  is the page dispatch and render happened after the securityContext has been clean in SecurityContextPersistenceFilter.\r\n\r\n### Expected Behavior\r\n\r\nwhen I use async controller, the jsp tag authorize should be work correctly.\r\n\r\n### Configuration\r\n\r\n\r\n\r\n### Version\r\n\r\nspring security: 4.1.2.RELEASE\r\n\r\n### Sample\r\n\r\n"}}
{"actor":{"display_login":"wayshall"}}