{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/1048","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/1048/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/1048/comments","events_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/1048/events","html_url":"https://github.com/spring-projects/spring-boot/issues/1048","id":35170646,"number":1048,"title":"Spring Security Principal missing from 4xx responses","user":{"login":"saschaszott","id":952735,"avatar_url":"https://avatars.githubusercontent.com/u/952735?v=3","gravatar_id":"","url":"https://api.github.com/users/saschaszott","html_url":"https://github.com/saschaszott","followers_url":"https://api.github.com/users/saschaszott/followers","following_url":"https://api.github.com/users/saschaszott/following{/other_user}","gists_url":"https://api.github.com/users/saschaszott/gists{/gist_id}","starred_url":"https://api.github.com/users/saschaszott/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/saschaszott/subscriptions","organizations_url":"https://api.github.com/users/saschaszott/orgs","repos_url":"https://api.github.com/users/saschaszott/repos","events_url":"https://api.github.com/users/saschaszott/events{/privacy}","received_events_url":"https://api.github.com/users/saschaszott/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spring-projects/spring-boot/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/spring-projects/spring-boot/labels/icebox","name":"icebox","color":"ededed"}],"state":"open","locked":false,"assignee":{"login":"dsyer","id":124075,"avatar_url":"https://avatars.githubusercontent.com/u/124075?v=3","gravatar_id":"","url":"https://api.github.com/users/dsyer","html_url":"https://github.com/dsyer","followers_url":"https://api.github.com/users/dsyer/followers","following_url":"https://api.github.com/users/dsyer/following{/other_user}","gists_url":"https://api.github.com/users/dsyer/gists{/gist_id}","starred_url":"https://api.github.com/users/dsyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dsyer/subscriptions","organizations_url":"https://api.github.com/users/dsyer/orgs","repos_url":"https://api.github.com/users/dsyer/repos","events_url":"https://api.github.com/users/dsyer/events{/privacy}","received_events_url":"https://api.github.com/users/dsyer/received_events","type":"User","site_admin":false},"milestone":null,"comments":9,"created_at":"2014-06-06T18:30:39Z","updated_at":"2015-05-15T16:45:00Z","closed_at":null,"body":"Hi folks,\r\n\r\ntoday I came across a strange behavior when using Spring Boot in conjunction with Spring Security and a custom error page setting.\r\n\r\nMy ``WebApplicationConfiguration`` class (which extends ``WebMvcConfigurerAdapter``) defines a ``EmbeddedServletContainerCustomizer`` bean:\r\n\r\n``` java\r\n@Bean\r\npublic EmbeddedServletContainerCustomizer containerCustomizer() {\r\n   return (container -> container.addErrorPages(\r\n                new ErrorPage(HttpStatus.BAD_REQUEST, \"/4x\"),\r\n                new ErrorPage(HttpStatus.UNAUTHORIZED, \"/4xx\"),\r\n                new ErrorPage(HttpStatus.FORBIDDEN, \"/4xx\"),\r\n                new ErrorPage(HttpStatus.NOT_FOUND, \"/4xx\"),\r\n                new ErrorPage(HttpStatus.METHOD_NOT_ALLOWED, \"/4xx\"),\r\n                new ErrorPage(HttpStatus.INTERNAL_SERVER_ERROR, \"/5xx\")));\r\n}\r\n```\r\n\r\nThe path ``/4xx`` (and ``/5xx`` as well) is handled by the following controller:\r\n\r\n``` java\r\n@Controller\r\npublic class ErrorPageController {\r\n\r\n   private static final Logger LOG = Logger.getLogger(ErrorPageController.class.getName());\r\n\r\n   @RequestMapping(value = { \"/4xx\", \"/5xx\" })\r\n   public String handleError(HttpServletRequest request, ModelMap map) {\r\n      String name = request.getUserPrincipal() != null ? request.getUserPrincipal().getName() : \"NULL\";\r\n      LOG.warn(\"user name is \" + name);\r\n\r\n     …\r\n   }\r\n}\r\n```\r\n\r\nWithin the controller method ``handleError`` I'm trying to get the name of the successfully authenticated user.\r\n\r\nIf I'm running the application (as a JAR file) with an embedded application server (Tomcat 7.0.52) the following output can be found in the log file\r\n\r\n```\r\nWARN [de.szott.mybootapp.web.controller.ErrorPageController.handleError:65] - user name is NULL\r\n```\r\n\r\nIf I'm running the application (as a WAR file) in a standalone Tomcat (same version) the log file states\r\n```\r\nWARN [de.szott.mybootapp.web.controller.ErrorPageController.handleError:65] - user name is johndoe\r\n```\r\n\r\nDoes anybody have a clue on how to fix this? Please note, that it's crucial for me to get the user name in the controller method since I want to output the name in the view (which is a Thymeleaf template in my case). Thanks!"},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/comments/102456237","html_url":"https://github.com/spring-projects/spring-boot/issues/1048#issuecomment-102456237","issue_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/1048","id":102456237,"user":{"login":"php-coder","id":87088,"avatar_url":"https://avatars.githubusercontent.com/u/87088?v=3","gravatar_id":"","url":"https://api.github.com/users/php-coder","html_url":"https://github.com/php-coder","followers_url":"https://api.github.com/users/php-coder/followers","following_url":"https://api.github.com/users/php-coder/following{/other_user}","gists_url":"https://api.github.com/users/php-coder/gists{/gist_id}","starred_url":"https://api.github.com/users/php-coder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/php-coder/subscriptions","organizations_url":"https://api.github.com/users/php-coder/orgs","repos_url":"https://api.github.com/users/php-coder/repos","events_url":"https://api.github.com/users/php-coder/events{/privacy}","received_events_url":"https://api.github.com/users/php-coder/received_events","type":"User","site_admin":false},"created_at":"2015-05-15T16:45:00Z","updated_at":"2015-05-15T16:45:00Z","body":">Are there any workarounds? Or does anyone have any ideas for a code change that I could work quick?\r\n\r\nI'm not sure is this a bug or not, because it [described in documentation][1] (but there is no words about Sprig Security):\r\n\r\n\r\n>N.B. if you register an ErrorPage with a path that will end up being handled by a Filter (e.g. as is common with some non-Spring web frameworks, like Jersey and Wicket), then the Filter has to be explicitly registered as an ERROR dispatcher (the default FilterRegistrationBean does not include the ERROR dispatcher type).\r\n\r\nThis is how I've fixed it for myself:\r\n\r\n```java\r\n// TODO: remove @Qualifier and inject by type\r\n// See for details: https://github.com/spring-projects/spring-boot/issues/2774\r\n@Bean\r\npublic FilterRegistrationBean getSpringSecurityFilterChainBindedToError(\r\n                @Qualifier(\"springSecurityFilterChain\") Filter springSecurityFilterChain) {\r\n\r\n        FilterRegistrationBean registration = new FilterRegistrationBean();\r\n        registration.setFilter(springSecurityFilterChain);\r\n        registration.setDispatcherTypes(EnumSet.allOf(DispatcherType.class));\r\n        return registration;\r\n}\r\n```\r\n\r\n[1]: http://docs.spring.io/spring-boot/docs/1.2.3.RELEASE/reference/htmlsingle/#boot-features-error-handling"}}