Describe the bug

I can't be 100% sure, but it seems to be a bug or misconfiguration to me. I can work to try to have a reproduce if required.

I suspect that somehow if I configure sessionManagement in using CustomDsl and applied to any SecurityFilterChain, it does not seem to have any effect.

So what happens was that when I try to run any HTTP request, it seems to use HttpSession cache, rather than re-authenticating on per request.

My understanding on certain concept might be wrong, if so, please let me know so I can correct it, in case any of my description of the issue is using the wrong terminology

As this is developed on airgap machine, I can't have all the logs but I will provide as much as I can, and more if required.

To Reproduce

Given the following

// project a
@Configuration(proxyBeanMethods = false)
@EnableWebSecurity(debug = true)
public class WebSecurityConfig {
    @Bean
    public SecurityFilterChain docsFilterChain(HttpSecurity http) throws Exception {
        return http
            .build();
    }
}

// project b
public class DummyDsl extends AbstractHttpConfigurer<DummyDsl, HttpSecurity> {
    @Override
    public void init(HttpSecurity http) throws Exception {
        http
			.formLogin(AbstractHttpConfigurer::disable)
			.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
    }

    public static DummyDsl dummyDsl() {
        return new DummyDsl();
    }
}

I have exported DummyDsl through spring.factories which is used in project-a, hence, all the configuration should apply, and it does (as far as I can tell for all except session). When I try any HTTP request, the logs looks like

since I can't copy the logs, I try to hand-type the key information

This is the logs when "bypassing" the authentication

FilterChainProxy: Securing POST /api/v1/....
FilterChainProxy: Invoking DisableEncodeUrlFilter (1/11)
... omitted
FilterChainProxy: Invoking RequestHeaderAuthenticationFilter(6/11)
HttpSessionSecurityContextRepository: Retrieved SecurityContextImpl [Authentication....] from SPRING_SECURITY_CONTEXT
RequestHeaderAuthenticationFilter: Did not authenticate since request did not match ...
FilterChainProxy: Invoking RequestCacheAwareFilter (7/11)
HttpSessionRequestCache: matchingRequestParameterName is required for getMatchingRequest to lookup a value, but not provided
... omitted

So the request went through, using the previous session? I tried to change my headers, but it didn't also seem to re-authenticate.

What I have tried

Based on the docs, I could provide a NullSecurityContextRepository even though I think I don't have to cause I already defined using STATELESS

public class DummyDsl extends AbstractHttpConfigurer<DummyDsl, HttpSecurity> {
    @Override
    public void init(HttpSecurity http) throws Exception {
        http
			.formLogin(AbstractHttpConfigurer::disable)
			.securityContext(context -> context.securityContextRepository(new NullSecurityContextRepository())
			.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
    }

    public static DummyDsl dummyDsl() {
        return new DummyDsl();
    }
}

But, after setting this, it works. Now, every request does re-authenticate and doesn't use HttpSession (it seem).

What I have also tried

Re-define STATELESS policy in project-a, and did not set securityContext

// project a
@Configuration(proxyBeanMethods = false)
@EnableWebSecurity(debug = true)
public class WebSecurityConfig {
    @Bean
    public SecurityFilterChain docsFilterChain(HttpSecurity http) throws Exception {
        return http
			.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .build();
    }
}

// project b
public class DummyDsl extends AbstractHttpConfigurer<DummyDsl, HttpSecurity> {
    @Override
    public void init(HttpSecurity http) throws Exception {
        http
			.formLogin(AbstractHttpConfigurer::disable)
			.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
    }

    public static DummyDsl dummyDsl() {
        return new DummyDsl();
    }
}

This also seem to work based on what I have tried

I also wanted to try

I wanted to try to setAllowSessionCreation to false (over using NullSecurityContextRepository), but not quite sure how to define it.

Expected behavior

The expected behavior should always authenticate per request, and the logs I expect to see should be something along

FilterChainProxy: Securing POST /api/v1/....
FilterChainProxy: Invoking DisableEncodeUrlFilter (1/11)
... omitted
FilterChainProxy: Invoking RequestHeaderAuthenticationFilter(6/11)
HttpSessionSecurityContextRepository: No HttpSession currently exists
SupplierDeferredSecurityContext: Created SecurityContextImpl [Null authentication]
SupplierDeferredSecurityContext: Created SecurityContextImpl [Null authentication]
RequestHeaderAuthenticationFilter: Authenticating null
RequestHeaderAuthenticationFilter: preAuthenticatePrincipal = xxxx, trying to authenticate
ProviderManager: Authenticating request with PreAuthenticatedAuthenticationProvider (1/1)
... omitted

Sample

I can try to submit a reproduce if required. I'm hoping that it's a rather straight-forward case of me not understanding enough, or having misconfiguration on my end than it is a bug. Please do let me know if more information is required as well.

Thanks!