Accessing the current user, in a spring controller, getAuthentication() returns null

Question

I have attempted to implement the solutions provided in this question.

However, none of them are working for me. In my abstract base controller, I have the following method (I also tried in helper class with static methods, but same problem):

public User getUser() {
  User user = 
    (User) SecurityContextHolder.getContext().getAuthentication().getPrincipal();       
}

the getAuthentication() is returning null, even though in my jsps, the following is working perfectly:

<sec:authentication property="principal.firstname" /> 

In that my custom user object is accesible.

Why does getAuthentication return null ?

Also, I tried passing in the Principal as parameter to my specific controller method, this is null resolves to null too ...

Why is my principal null, but yet the jsp is working ?

Answer 1

Make sure you don't have filters = "none" in <intercept-url> for your controller's URL, it disables Spring Security filters, thus security context doesn't get populated.

If you need to make your controller accessible for everyone, use other approaches.