SEC-1788: Avoid unnecessary call to getPreAuthenticatedPrincipal() in AbstractPreAuthenticatedProcessingFilter when not checking for principal changes is not enabled.

web/src/main/java/org/springframework/security/web/authentication/preauth/AbstractPreAuthenticatedProcessingFilter.java

@@ -130,24 +130,28 @@ public abstract class AbstractPreAuthenticatedProcessingFilter extends GenericFi
             return true;
         }
 
+        if (!checkForPrincipalChanges) {
+            return false;
+        }
+
         Object principal = getPreAuthenticatedPrincipal(request);
-        if (checkForPrincipalChanges &&
-                !currentUser.getName().equals(principal)) {
-            logger.debug("Pre-authenticated principal has changed to " + principal + " and will be reauthenticated");
 
-            if (invalidateSessionOnPrincipalChange) {
-                HttpSession session = request.getSession(false);
+        if (currentUser.getName().equals(principal)) {
+            return false;
+        }
 
-                if (session != null) {
-                    logger.debug("Invalidating existing session");
-                    session.invalidate();
-                }
-            }
+        logger.debug("Pre-authenticated principal has changed to " + principal + " and will be reauthenticated");
 
-            return true;
+        if (invalidateSessionOnPrincipalChange) {
+            HttpSession session = request.getSession(false);
+
+            if (session != null) {
+                logger.debug("Invalidating existing session");
+                session.invalidate();
+            }
         }
 
-        return false;
+        return true;
     }
 
     /**