spring security - access request parameters inside UserDetailsService implementation

Question

I'm working on a java spring mvc application. I have implemented the UserDetailsService interface like this:

@Component
@Transactional
public class SecurityDAO implements UserDetailsService{

     @Override
     public UserDetails loadUserByUsername(final String username) throws UsernameNotFoundException {
         ...
     }

     ....
}

I need to find the user login url inside loadUserByUsername method(because the project has multiple login urls). In fact, I want to access request parameters inside UserDetailsService implementation.

dambros · Accepted Answer · 2016-04-20T07:44:22.740

12

Just inject the request on your service:

 @Autowired
 private HttpServletRequest request;

For it to work you need to register RequestContextListener previously, though:

@Bean 
public RequestContextListener requestContextListener(){
    return new RequestContextListener();
}

edited Apr 20 '16 at 07:44

answered Apr 20 '16 at 07:39

dambros

4,252
1
23
39

Cause `java.lang.IllegalStateException: No thread-bound request found: Are you referring to request attributes outside of an actual web request...` – hamed Apr 20 '16 at 08:02
You didn't declared the `RequestContextListener`. Are you using Spring Boot? – dambros Apr 20 '16 at 08:04
No, I don't use spring boot. I declared `RequestContextListener` in my `SecurityConfig` class. – hamed Apr 20 '16 at 08:06
Do you happen to be using web.xml as well? – dambros Apr 20 '16 at 08:10
I have `web.xml` in my project. But it only has `` tag. – hamed Apr 20 '16 at 08:13
1

In this case add a new listener with `org.springframework.web.context.request.RequestContextListener` instead. – dambros Apr 20 '16 at 08:14

score 8 · Answer 2 · edited May 23 '17 at 12:18

All the information is available through HttpServletRequest. You can obtain it by:

Dependency injection

The easiest way would be to inject servlet request directly into your UserDetailsService: class:

public MyDetailsService implements UserDetailsService {

  @Autowired
  private HttpServletRequest request;

  //...

}

or

public MyDetailsService implements UserDetailsService {

  @Autowired
  private HttpServletRequest request;

    public UserDetails loadUserByUsername(String username){
                HttpServletRequest request  =
             ((ServletRequestAttributes)RequestContextHolder.getRequestAttributes())
                    .getRequest();
    }

}

Remember to add the following listener to your web.xml if you are not spring boot:

<listener>
    <listener-class>
        org.springframework.web.context.request.RequestContextListener
    </listener-class>
</listener>

If you are using spring boot, add below this.

@Bean 
public RequestContextListener requestContextListener(){
    return new RequestContextListener();
}

UPDATE: This works because Spring injects special scoped proxy implementing HttpServletRequest, so you are able to access request-scoped request "bean" from singleton-scoped MyDetailsService. Under the hood every call to request's parameters is routed to org.springframework.web.context.request.RequestContextHolder#requestAttributesHolder ThreadLocal which you can also access directly. As you can see Spring is very flexible when it comes to scoping rules. It just works.

`RequestContextHolder`

Another approach is to use RequestContextHolder:

HttpServletRequest request = 
  ((ServletRequestAttributes) RequestContextHolder.
    currentRequestAttributes()).
    getRequest();

spring security - access request parameters inside UserDetailsService implementation

4 Answers4

Dependency injection

`RequestContextHolder`

Further reading:

Linked