How can I use boolean parameters from application.properties in spring security context configuration xml file?

Question

I am trying to use a boolean parameter from my application.properties in my spring-security configuration xml file. I don't know why I can use not-boolean parameters, but I get an error for boolean.

How can I use boolean parameters?

Here is my application.properties:

JDBC_CONNECTION_STRING=jdbc:mysql://localhost:3306/schema?user=username&password=password
protocol=http
USE_SECURE=false

My spring-security.xml is:

< remember-me user-service-ref="internalUserDetails" data-source-ref="dataSource" key="this-is-my-key02203452416fw" use-secure-cookie="${USE_SECURE}" />

... but I get this error: cvc-datatype-valid.1.2.1: '${USE_SECURE}' is not a valid value for 'boolean'

I have also tried to set USE_SECURE=False but I get the same error again. How can I use boolean parameters in the spring security configuration xml file?

Here is my web.xml:

<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
    version="3.0" >

    <display-name> Name-MyApp</display-name> 

    <welcome-file-list>
        <welcome-file>index.html</welcome-file>
        <welcome-file>index.jsp</welcome-file>
    </welcome-file-list>

    <!-- Servlets -->
    <servlet>
        <servlet-name>MyApp</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>

    <!-- Servlets Mappings -->
    <servlet-mapping>
        <servlet-name>MyApp</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
                /WEB-INF/servlet-context.xml,
            /WEB-INF/spring-security.xml
        </param-value>
    </context-param>

    <!-- Filters -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>httpMethodFilter</filter-name>
        <servlet-name>MyApp</servlet-name>
    </filter-mapping>    

    <filter> 
        <filter-name>httpMethodFilter</filter-name>
        <filter-class>org.springframework.web.filter.HiddenHttpMethodFilter</filter-class>
    </filter> 

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
</web-app> 

Answer 1

The xsd schema definition of the security namespace only allows boolean values in the use-secure-cookie attribute. If you don't specify one of the allowed literals ("true" or "false"), your xml won't pass the schema validation, and won't get even parsed.

So if you use the security namespace configuration, you won't be able to use external properties to set this value. To prove my point, here is the relevant code snippet from RememberMeBeanDefinitionParser.parse():

String useSecureCookie = element.getAttribute("use-secure-cookie");
if (StringUtils.hasText(useSecureCookie)) {
    services.getPropertyValues().addPropertyValue(
                    "useSecureCookie", Boolean.valueOf(useSecureCookie));
}

As you can see the attribute is straight away converted to boolean, so no mechanism is given any chance to further process the value.

I'm not completely sure, but chances are that this could be fixed by simply relaxing the xsd to allow any string value, and pass that value to the bean definition (services above) without converting it to boolean. Then a PropertyPlaceholderConfigurer could later resolve the given value if it happens to be a property placeholder.

If you want to give it a try, feel free to open a ticket in the Spring Security issue tracker.