I have a problem with Spring Security configuration.
When I log in on one computer as a user1 and then I will log in as a user2 on another computer, the first computer after refresh sees everything as a user2.
In other words, it is impossible to have two sessions with different users at the same time.
Configuration:
@Configuration @EnableWebSecurity public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Autowired public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception { auth.inMemoryAuthentication().withUser("user1").password("user1").roles("USER"); auth.inMemoryAuthentication().withUser("user2").password("user2").roles("USER"); } @Override protected void configure(HttpSecurity http) throws Exception { CharacterEncodingFilter filter = new CharacterEncodingFilter(); filter.setEncoding("UTF-8"); filter.setForceEncoding(true); http.addFilterBefore(filter,CsrfFilter.class); http.csrf().disable(); http.authorizeRequests() .antMatchers("/", "/login").permitAll() .antMatchers("/questions/**").access("hasRole('USER')") .and().formLogin().loginPage("/login").defaultSuccessUrl("/questions") .usernameParameter("ssoId").passwordParameter("password"); }
Spring Security version: 4.0.1.RELEASE
Spring version: 4.1.6.RELEASE
Login request in controller:
@RequestMapping(value = { "/", "/login" }, method = RequestMethod.GET) public String homePage() { return "login"; }
Advertisement
Answer
@Autowired public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception { auth.inMemoryAuthentication().withUser("user1").password("user1").roles("USER"); auth.inMemoryAuthentication().withUser("user2").password("user2").roles("USER"); }
With that, you are saying that is the user 2 on the session
@Autowired public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception { auth.inMemoryAuthentication().withUser(getUser()).password(getPassword()).roles("USER"); }