Auto-configure RequestAttributeSecurityContextRepository for OAuth2 resource server

This appears to have broken in 2.6.X as older versions (I tried 2.5.X) do not exhibit the behavior described below.

Step 1: provide a WebSecurityConfigurerAdapter and configure it with the STATELESS session creation policy:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and().authorizeRequests()
                .antMatchers("/test-user").hasRole("USER")
                .antMatchers("/test-admin").hasRole("ADMIN")
                .antMatchers("/error").authenticated()
                .and().httpBasic();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("user").password("{noop}password").roles("USER").and()
                .withUser("admin").password("{noop}password").roles("ADMIN", "USER");
    }
}

Step 2: setup a simple controller

@Controller
public class ExampleController {

    @GetMapping(path = {"test-user", "test-admin"})
    public void test(HttpServletResponse response) {
        response.setStatus(HttpServletResponse.SC_OK);
    }
}

Step 3: run the application and send a request to a resource the user is not authorized to view

curl -v -u user:password http://localhost:8080/test-admin

Expected Behavior: the user receives a HTTP 403 Forbidden response status code and a response body (such as the below):

{
   "timestamp":"2022-02-04T23:42:41.621+00:00",
   "status":403,
   "error":"Forbidden",
   "path":"/test-admin"
}

Actual Behavior: the user receives a HTTP 403 Forbidden response status code with no response body

Note: if the STATELESS session creation policy is removed from the above configuration, it works as expected.

[mbhave]

@datagitlies Spring Boot 2.6.x uses Spring security 5.6.x, so yes it won’t be using spring security 5.7.x

[svilen-ivanov-kubit]

@svilen-ivanov-kubit A sample would be very helpful, thank you.

I updated our WebSecurityConfigurerAdapter by removing some cruft and the issue is no longer reproducible. Thank you.