title: Spring autowireing a session scope bean in AuthenticationSuccessHandler is not working
body: <p>I am using spring security and I want to initial an object  <code>User</code> in session after user success login.</p>
  
  <p>The security configuration is as below:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @PropertySource("classpath://configs.properties")
  public class SecurityContextConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private Environment env;
  
      @Autowired
      SimpleUrlAuthenticationSuccessHandler simpleUrlAuthenticationSuccessHandler;
  
  
      @Autowired
      public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
  
          auth.inMemoryAuthentication()
              .withUser(env.getProperty("security.user1.userid"))
              .password(env.getProperty("security.user1.pass"))
              .roles(env.getProperty("security.user1.role"));
      }
  
  
      @Override   
      protected void configure(HttpSecurity http) throws Exception {
  
          http.authorizeRequests().antMatchers("/*.cm")
                  .access("hasRole('ADMIN')")
                  .and()
                  .formLogin()
                      .loginPage("/public-page.cm")
                      .loginProcessingUrl("/j_spring_security_check")
                      .usernameParameter("j_username")
                      .passwordParameter("j_password")
                      .successHandler(simpleUrlAuthenticationSuccessHandler)
                      .failureUrl("/public-page-authentication-failure.cm")
                  .and()
                      .logout()
                      .logoutSuccessUrl("/public-page.cm")
                      .invalidateHttpSession(true)
                      .logoutUrl("/j_spring_security_logout")
                  .and()
                      .csrf().disable();
  
      }
  
      /**
       * configure which patterns the spring security should not be applied
       */
      @Override
      public void configure(WebSecurity web) throws Exception {
          web.ignoring().antMatchers("/index.jsp", "/public-page.jsp", "/public-page.cm",
                  "/public-page-authentication-failure.cm", "/images/**", "/css/**", "/js/**");
      }
  
  }
  </code></pre>
  
  <p>The <code>User</code> is </p>
  
  <pre><code>@Component
  @Scope("session")
  public class User {
  
      private String selectedSystem;
      private String selectedBank;
  </code></pre>
  
  <p>}</p>
  
  <p>The <code>SimpleUrlAuthenticationSuccessHandler</code> is as:</p>
  
  <pre><code>@Component
  public class SimpleUrlAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
      protected Log logger = LogFactory.getLog(this.getClass());
  
      @Autowired
      private User user;
  </code></pre>
  
  <p>The error is:</p>
  
  <pre><code>Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'user': Scope 'session' is not active for the current thread; consider defining a scoped proxy for this bean if you intend to refer to it from a singleton; nested exception is java.lang.IllegalStateException: No thread-bound request found: Are you referring to request attributes outside of an actual web request, or processing a request outside of the originally receiving thread? If you are actually operating within a web request and still receive this message, your code is probably running outside of DispatcherServlet/DispatcherPortlet: In this case, use RequestContextListener or RequestContextFilter to expose the current request.
      at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:355)
      at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
  </code></pre>
  
  <p>I have added the RequestContextListener to web app as below:</p>
  
  <pre><code>public class WebAppInitializer implements WebApplicationInitializer {
  
      @Override
      public void onStartup(ServletContext servletContext) throws ServletException {
          AnnotationConfigWebApplicationContext appContext = new AnnotationConfigWebApplicationContext();
          appContext.register(DatabaseContextConfig.class);
  
  
          servletContext.addListener(new ContextLoaderListener(appContext));
          servletContext.addListener(new RequestContextListener());
  
          //Add Spring security filter
          FilterRegistration.Dynamic springSecurityFilterChain = servletContext.addFilter(
                  AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME,  DelegatingFilterProxy.class);
          springSecurityFilterChain.addMappingForUrlPatterns(EnumSet.allOf(DispatcherType.class), false, "/*");
  
      }
  
  }
  </code></pre>
  
  <p>I have read <a href="https://stackoverflow.com/questions/5420161/how-to-retrieve-a-session-scoped-bean-inside-authenticationsuccesshandler">How to retrieve a session-scoped bean inside AuthenticationSuccessHandler?</a> but it doesn't help</p>
  
  <p>When I try to <code>Autowire</code> none session bean, it works fine.</p>
  
  <p>Any idea how to fix it ?!</p>