title: Spring Security: authentication details are null in controller
body: <p>Trying to combine Spring Session (to Redis) with Spring Security (DB-based). Authentication works just fine, and if I add listener:</p>
  
  <pre><code>import org.springframework.context.ApplicationListener;
  import org.springframework.security.authentication.event.InteractiveAuthenticationSuccessEvent;
  import org.springframework.security.core.Authentication;
  import org.springframework.security.core.context.SecurityContextHolder;
  import org.springframework.stereotype.Component;
  import org.springframework.web.context.request.RequestContextHolder;
  import org.springframework.web.context.request.ServletRequestAttributes;
  
  import javax.servlet.http.HttpSession;
  
  @Component
  public class AuthenticationSuccessListener implements ApplicationListener&lt;InteractiveAuthenticationSuccessEvent&gt; {
  
  
      @Override
      public void onApplicationEvent(InteractiveAuthenticationSuccessEvent event) {
          Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
          System.out.println("authentication: " + authentication.getName());
  
          ServletRequestAttributes attr = (ServletRequestAttributes) RequestContextHolder.currentRequestAttributes();
          HttpSession currentSession = attr.getRequest().getSession();
          System.out.println("session: " + currentSession.getAttribute("SESSION_DETAILS"));
      }
  }
  </code></pre>
  
  <p>Then it nicely prints:</p>
  
  <pre><code>authentication: admin
  session: app.session.SessionDetails@694daf33
  </code></pre>
  
  <p>And Redis store is updated as well:</p>
  
  <pre><code>127.0.0.1:6379&gt; keys *
  1) "spring:session:sessions:c7b0fc2c-3148-4895-9aef-78dfc8443585"
  2) "spring:session:expirations:1523615100000"
  3) "spring:session:sessions:expires:02acfbd4-93e7-44dc-9b61-38473a8a9ae7"
  4) "spring:session:sessions:expires:c7b0fc2c-3148-4895-9aef-78dfc8443585"
  5) "spring:session:index:org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME:admin"
  </code></pre>
  
  <p>But when I do in <code>@Controller</code>:</p>
  
  <pre><code>@RequestMapping("/")
  public String index(Principal principal, Model model) {
      Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
      System.out.println("authentication: " + authentication.getName());
  
      ServletRequestAttributes attr = (ServletRequestAttributes) RequestContextHolder.currentRequestAttributes();
      HttpSession currentSession = attr.getRequest().getSession();
      System.out.println("session: " + currentSession.getAttribute("SESSION_DETAILS"));
  
      return "index";
  }
  </code></pre>
  
  <p>Then I see the following:</p>
  
  <pre><code>authentication: null
  session: app.session.SessionDetails@1225ad92
  </code></pre>
  
  <p>New session is created and that is OK, but authentication details are gone. Which is a big surprise, as security configuration allows only authorized requests:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http
              .authorizeRequests()
              .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()
              .anyRequest().authenticated()
              .and()
              .formLogin()
              .loginPage("/login")
              .permitAll();
  }
  </code></pre>
  
  <p>To sum things up, I see secured content, but authorization details are set to null. How come?</p>