spring-security-kerberos icon indicating copy to clipboard operation
spring-security-kerberos copied to clipboard

SpnegoAuthenticationProcessingFilter should not continue filter chain on successful authentication

Open alt250 opened this issue 9 years ago • 0 comments

Currently SpnegoAuthenticationProcessingFilter.doFilter() is doing

        if (header != null && (header.startsWith("Negotiate ") || header.startsWith("Kerberos "))) {
...
            if (successHandler != null) {
                successHandler.onAuthenticationSuccess(request, response, authentication);
            }
        }
        chain.doFilter(request, response);

when successHandler is SimpleUrlAuthenticationSuccessHandler, the success handler will commit the response thus continuing the filter chain will fail with "IllegalStateException Committed" if a downstream filter calls response.send*()

alt250 avatar Aug 02 '16 15:08 alt250