Search code examples
spring-mvcspring-securitywebsocketspring-websocket

Access UserDetails object in Websocket session Spring MVC

In a call sent over a websocket connection in a Spring MVC 4 application, I can get a java.security.Principal object when adding this as a parameter in the method.

However, this basicly only has the username in it, and I need the (extended) UserDetails object created during logging in.

SecurityContextHolder.getContext().getAuthentication() returns null. As I understood because spring creates a special session for handling the websocket connections.

The Question: Is there a way to access the securitycontext from inside the websocket session/thread?

(Being able to access a session bean would suffice as well).

Solution

  • @AuthenticationPrincipal is specifically for REST/MVC methods.

    However, you can get pretty close by adding an argument of Type java.security.Principle to your @MessageMapping annotated method and then taking the real UserDetails object from it as follows:

    FooUserDetails currentUser = (FooUserDetails) ((Authentication) user).getPrincipal();

    This works for me for Spring Boot 1.5.4