Set NullRequestCache when session management disabled

[dukcode]

  @Bean
  public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

    http
        .authorizeHttpRequests(request -> request.anyRequest().authenticated())
        .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

    return http.build();
  }

When I configure sessionManagement to STATELESS like upper code, spring-security setsRequestCache of ExceptionTranslationFilter to NullRequestCache like next image.

  @Bean
  public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

    http
        .authorizeHttpRequests(request -> request.anyRequest().authenticated())
        .sessionManagement(AbstractHttpConfigurer::disable);

    return http.build();
  }

But when I configure sessionManagement disabled, RequestCache of ExceptionTranslationFilter is HttpSessionRequestCache. Please see image and output from Spring Security debug mode.

I think that RequestCache should be NullRequestCache.

[pivotal-cla]

@dukcode Please sign the Contributor License Agreement!

Click here to manually synchronize the status of this Pull Request.

See the FAQ for frequently asked questions.

[pivotal-cla]

@dukcode Thank you for signing the Contributor License Agreement!

[marcusdacoregio]

Hi @dukcode, have you discussed this with the team before submitting the PR? Asking because I do not think that we want to do this since sessionManagement() is really only about how the session is handled around authentication. If you disable it, it won't make any configuration, and, therefore, will rely on the other defaults, like the requestCache().

[dukcode]

Hi @marcusdacoregio!

In ExceptionTranslationFilter, it calls requestCache.saveRequest(request, response)

When we set sessionManagement() to disable, in ExceptionTranslationFilter http session is created because RequestCache is set to HttpSessionRequestCache.

However, when we set sessionManagement() to STATELESS, RequestCache is set to NullRequestCache. So, there is no session creation.

So I think it should work in same way in both config situation.

[marcusdacoregio]

When we set sessionManagement() to disable, in ExceptionTranslationFilter http session is created because RequestCache is set to HttpSessionRequestCache.

This is expected based on what I mentioned before, you are disabling session management but are keeping the defaults of the other configurations. If you do not want to have sessions at all, just set it to STATELESS, otherwise, if you are disabling it, you must also configure the RequestCache to use NullRequestCache.

[dc-oe]

We are seeing the requestcache draining our form data when looking for continue. It looks similar to what issue 13731 is seeing. Our current solution is to disable the optimization and get it back to 5.8 behavior. You can't drain the input stream looking for something that isn't there. We would like to know if we can fix this through configuration. We use XML and not annotations.

From the Jakarta Javadoc:
If the parameter data was sent in the request body, such as occurs with an HTTP POST request, then reading the body directly via getInputStream() or getReader() can interfere with the execution of this method.

[marcusdacoregio]

I will close this with what was mentioned in this comment.

@dc-oe it sounds like the bug is not related to this PR, can you add your comments to #13731 if they are related or open a new issue?