title: Pre-Authentication / Single SignOn using Spring Security
body: <p>I am developing two web applications where one is a server app and the other is a client app, both are using Spring Security. My use case is such that after a user logs into the server app, the user can then access the client app from links within the server app. Since the user should not have to log in again when they click on these links (part of my requirements), I decided to use a strategy similar to Single SignOn in order to forward their authentication information from the server app to the client app.</p>
  
  <p>On the client app, I am using Spring Security's <code>RequestHeaderAuthenticationFilter</code> to look for a custom request header that is set by the server app. </p>
  
  <ol>
  <li><p>If this custom header is found, do I have to do any further validation that this request is trustworthy? In <a href="http://static.springsource.org/spring-security/site/docs/3.1.x/reference/springsecurity-single.html#preauth" rel="nofollow">Spring's Pre-Authentication doc</a>,  <code>RequestHeaderAuthenticationFilter</code> does not perform any authentication and will assume the request to be from the user specified in the <code>SM_USER</code> attribute. How do I ensure that the request is genuine?</p></li>
  <li><p>How do I send the user from one app to another with a custom header in the http request? Redirecting the request does not work as the header information will be lost. Forwarding does not work as the forwarded request does not go through the configured Spring Security filters on the client app, thus the request is never "authenticated" and no session is created.</p></li>
  </ol>