Contribute to Spring Security open source

Issue: ConcurrentSessionFilter breaks permitAll endpoint on session expiration PR: Add ContinueRequestSessionInformationExpiredStrategy

Introduction

Last year, during the open source study, I was able to become a contributor by contributing to Spring-batch open source. I promised myself that I would continue to contribute after that, but in the end, it was only after participating in the second study that I was able to post a Spring-Security PR.

Open source analysis and solutions

The issue itself was that the session was managed by the ConcurrentSessionFilter, which manages concurrent connections, but when the session expired, early return was processed without any additional processing, so subsequent filter processing was not performed. Since this was an issue for which the maintainer had provided direction to solve the problem, it was easy to approach.

static class ContinueRequestSessionInformationExpiredStrategy implements SessionInformationExpiredStrategy {
@Override
public void onExpiredSessionDetected(SessionInformationExpiredEvent event) throws ServletException, IOException {
event.getFilterChain().doFilter(event.getRequest(), event.getResponse());
}
}

The issue I was concerned about when implementing was whether I should create ContinueRequestSessionInformationExpiredStrategy and use it as a default strategy, or whether I should allow the user to enter a strategy that suits their taste. The existing session strategy uses ResponseBodySessionInformationExpiredStrategy, which simply returns session expiration. First of all, the PR itself was applied by creating the maintainer presentation code separately as a class so that it could be selected like any other strategy and setting the ConcurrentSessionFilter with it. I could have done the default processing, but I thought that performing the filter after the session ends could be an unnecessary process. Currently, there is a possibility that this part will change while coordinating with the maintainer.

Study Retrospective

The last study was for a month, so I felt a bit lazy in between, but this time, I decided on an issue for a week and set aside a day to raise a PR within 2 hours, which was good because I was able to focus more on it. And before, when I studied Spring security in Action as a book, There were times when it was a bit boring, but I understood it more quickly when I saw the actual code.

Open source contribution success

I made an open source contribution in March of this year, but after review by the maintainer, the issue was recently closed after almost half a year. It seems like it was so long ago that I don't remember much, but I felt proud that it helped with Spring Security, which I use myself. It was amazing to be able to contribute to Spring Security following my previous contribution to Spring Batch, and I wanted to take on the challenge of having the skills to contribute to Spring open source in the future.