SEC-398: Lazy update of 'filterApplied' to true

core/src/main/java/org/acegisecurity/context/HttpSessionContextIntegrationFilter.java

@@ -32,6 +32,7 @@ import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.util.Assert;
 import org.springframework.util.ReflectionUtils;
+import org.springframework.web.util.WebUtils;
 
 /**
  * Populates the {@link SecurityContextHolder} with information obtained from
@@ -96,11 +97,13 @@ import org.springframework.util.ReflectionUtils;
  * @version $Id: HttpSessionContextIntegrationFilter.java 1784 2007-02-24
  *          21:00:24Z luke_t $
  */
-public class HttpSessionContextIntegrationFilter implements InitializingBean, Filter {
+public class HttpSessionContextIntegrationFilter implements InitializingBean,
+		Filter {
 	// ~ Static fields/initializers
 	// =====================================================================================
 
-	protected static final Log logger = LogFactory.getLog(HttpSessionContextIntegrationFilter.class);
+	protected static final Log logger = LogFactory
+			.getLog(HttpSessionContextIntegrationFilter.class);
 
 	static final String FILTER_APPLIED = "__acegi_session_integration_filter_applied";
 
@@ -172,13 +175,16 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean, Fi
 	// ========================================================================================================
 
 	public void afterPropertiesSet() throws Exception {
-		if ((this.context == null) || (!SecurityContext.class.isAssignableFrom(this.context))) {
-			throw new IllegalArgumentException("context must be defined and implement SecurityContext "
-					+ "(typically use org.acegisecurity.context.SecurityContextImpl; existing class is " + this.context
-					+ ")");
+		if ((this.context == null)
+				|| (!SecurityContext.class.isAssignableFrom(this.context))) {
+			throw new IllegalArgumentException(
+					"context must be defined and implement SecurityContext "
+							+ "(typically use org.acegisecurity.context.SecurityContextImpl; existing class is "
+							+ this.context + ")");
 		}
 
-		if ((forceEagerSessionCreation == true) && (allowSessionCreation == false)) {
+		if ((forceEagerSessionCreation == true)
+				&& (allowSessionCreation == false)) {
 			throw new IllegalArgumentException(
 					"If using forceEagerSessionCreation, you must set allowSessionCreation to also be true");
 		}
@@ -190,59 +196,60 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean, Fi
 	public void destroy() {
 	}
 
-	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException,
-			ServletException {
+	public void doFilter(ServletRequest request, ServletResponse response,
+			FilterChain chain) throws IOException, ServletException {
 		boolean filterApplied = false;
 		if ((request != null) && (request.getAttribute(FILTER_APPLIED) != null)) {
 			// ensure that filter is only applied once per request
+			System.out.println("Filter already applied so moving on");
 			chain.doFilter(request, response);
-		}
-		else {
-			if (request != null) {
-				filterApplied = true;
-				request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
-			}
-
+		} else {
 			HttpSession httpSession = null;
 			boolean httpSessionExistedAtStartOfRequest = false;
 
 			try {
-				httpSession = ((HttpServletRequest) request).getSession(forceEagerSessionCreation);
-			}
-			catch (IllegalStateException ignored) {
+				httpSession = ((HttpServletRequest) request)
+						.getSession(forceEagerSessionCreation);
+			} catch (IllegalStateException ignored) {
 			}
 
 			if (httpSession != null) {
 				httpSessionExistedAtStartOfRequest = true;
 
-				Object contextFromSessionObject = httpSession.getAttribute(ACEGI_SECURITY_CONTEXT_KEY);
+				Object contextFromSessionObject = httpSession
+						.getAttribute(ACEGI_SECURITY_CONTEXT_KEY);
 
 				if (contextFromSessionObject != null) {
 					// Clone if required (see SEC-356)
 					if (cloneFromHttpSession) {
-						Assert.isInstanceOf(Cloneable.class, contextFromSessionObject,
+						Assert
+								.isInstanceOf(Cloneable.class,
+										contextFromSessionObject,
 										"Context must implement Clonable and provide a Object.clone() method");
 						try {
-							Method m = contextFromSessionObject.getClass().getMethod("clone", new Class[] {});
+							Method m = contextFromSessionObject.getClass()
+									.getMethod("clone", new Class[] {});
 							if (!m.isAccessible()) {
 								m.setAccessible(true);
 							}
-							contextFromSessionObject = m.invoke(contextFromSessionObject, new Object[] {});
-						}
-						catch (Exception ex) {
+							contextFromSessionObject = m.invoke(
+									contextFromSessionObject, new Object[] {});
+						} catch (Exception ex) {
 							ReflectionUtils.handleReflectionException(ex);
 						}
 					}
 
 					if (contextFromSessionObject instanceof SecurityContext) {
 						if (logger.isDebugEnabled()) {
-							logger.debug("Obtained from ACEGI_SECURITY_CONTEXT a valid SecurityContext and "
-									+ "set to SecurityContextHolder: '" + contextFromSessionObject + "'");
+							logger
+									.debug("Obtained from ACEGI_SECURITY_CONTEXT a valid SecurityContext and "
+											+ "set to SecurityContextHolder: '"
+											+ contextFromSessionObject + "'");
 						}
 
-						SecurityContextHolder.setContext((SecurityContext) contextFromSessionObject);
-					}
-					else {
+						SecurityContextHolder
+								.setContext((SecurityContext) contextFromSessionObject);
+					} else {
 						if (logger.isWarnEnabled()) {
 							logger
 									.warn("ACEGI_SECURITY_CONTEXT did not contain a SecurityContext but contained: '"
@@ -255,60 +262,66 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean, Fi
 
 						SecurityContextHolder.setContext(generateNewContext());
 					}
-				}
-				else {
+				} else {
 					if (logger.isDebugEnabled()) {
-						logger.debug("HttpSession returned null object for ACEGI_SECURITY_CONTEXT - new "
+						logger
+								.debug("HttpSession returned null object for ACEGI_SECURITY_CONTEXT - new "
 										+ "SecurityContext instance associated with SecurityContextHolder");
 					}
 
 					SecurityContextHolder.setContext(generateNewContext());
 				}
-			}
-			else {
+
+			} else {
 				if (logger.isDebugEnabled()) {
-					logger.debug("No HttpSession currently exists - new SecurityContext instance "
+					logger
+							.debug("No HttpSession currently exists - new SecurityContext instance "
 									+ "associated with SecurityContextHolder");
 				}
 
 				SecurityContextHolder.setContext(generateNewContext());
 			}
 
+			// end synch
+
 			// Make the HttpSession null, as we want to ensure we don't keep
 			// a reference to the HttpSession laying around in case the
 			// chain.doFilter() invalidates it.
 			httpSession = null;
 
 			// Proceed with chain
-			int contextWhenChainProceeded = SecurityContextHolder.getContext().hashCode();
+			int contextWhenChainProceeded = SecurityContextHolder.getContext()
+					.hashCode();
 
 			try {
+				filterApplied = true;
+				request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
 				chain.doFilter(request, response);
-			}
-			catch (IOException ioe) {
+			} catch (IOException ioe) {
 				throw ioe;
-			}
-			catch (ServletException se) {
+			} catch (ServletException se) {
+
 				throw se;
-			}
-			finally {
+			} finally {
 				// do clean up, even if there was an exception
 				// Store context back to HttpSession
 				try {
-					httpSession = ((HttpServletRequest) request).getSession(false);
-				}
-				catch (IllegalStateException ignored) {
+					httpSession = ((HttpServletRequest) request)
+							.getSession(false);
+				} catch (IllegalStateException ignored) {
 				}
 
 				if ((httpSession == null) && httpSessionExistedAtStartOfRequest) {
 					if (logger.isDebugEnabled()) {
-						logger.debug("HttpSession is now null, but was not null at start of request; "
+						logger
+								.debug("HttpSession is now null, but was not null at start of request; "
 										+ "session was invalidated, so do not create a new session");
 					}
 				}
 
 				// Generate a HttpSession only if we need to
-				if ((httpSession == null) && !httpSessionExistedAtStartOfRequest) {
+				if ((httpSession == null)
+						&& !httpSessionExistedAtStartOfRequest) {
 					if (!allowSessionCreation) {
 						if (logger.isDebugEnabled()) {
 							logger
@@ -317,23 +330,24 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean, Fi
 											+ "(because the allowSessionCreation property is false) - SecurityContext thus not "
 											+ "stored for next request");
 						}
-					}
-					else if (!contextObject.equals(SecurityContextHolder.getContext())) {
+					} else if (!contextObject.equals(SecurityContextHolder
+							.getContext())) {
 						if (logger.isDebugEnabled()) {
-							logger.debug("HttpSession being created as SecurityContextHolder contents are non-default");
+							logger
+									.debug("HttpSession being created as SecurityContextHolder contents are non-default");
 						}
 
 						try {
-							httpSession = ((HttpServletRequest) request).getSession(true);
+							httpSession = ((HttpServletRequest) request)
+									.getSession(true);
+						} catch (IllegalStateException ignored) {
 						}
-						catch (IllegalStateException ignored) {
-						}
-					}
-					else {
+					} else {
 						if (logger.isDebugEnabled()) {
 							logger
 									.debug("HttpSession is null, but SecurityContextHolder has not changed from default: ' "
-											+ SecurityContextHolder.getContext()
+											+ SecurityContextHolder
+													.getContext()
 											+ "'; not creating HttpSession or storing SecurityContextHolder contents");
 						}
 					}
@@ -345,11 +359,12 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean, Fi
 				// actually changed (see JIRA SEC-37)
 				if ((httpSession != null)
 						&& (SecurityContextHolder.getContext().hashCode() != contextWhenChainProceeded)) {
-					httpSession.setAttribute(ACEGI_SECURITY_CONTEXT_KEY, SecurityContextHolder.getContext());
+					httpSession.setAttribute(ACEGI_SECURITY_CONTEXT_KEY,
+							SecurityContextHolder.getContext());
 
 					if (logger.isDebugEnabled()) {
-						logger.debug("SecurityContext stored to HttpSession: '" + SecurityContextHolder.getContext()
-								+ "'");
+						logger.debug("SecurityContext stored to HttpSession: '"
+								+ SecurityContextHolder.getContext() + "'");
 					}
 				}
 
@@ -361,20 +376,22 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean, Fi
 				SecurityContextHolder.clearContext();
 
 				if (logger.isDebugEnabled()) {
-					logger.debug("SecurityContextHolder set to new context, as request processing completed");
+					logger
+							.debug("SecurityContextHolder set to new context, as request processing completed");
 				}
+
 			}
+
 		}
+
 	}
 
 	public SecurityContext generateNewContext() throws ServletException {
 		try {
 			return (SecurityContext) this.context.newInstance();
-		}
-		catch (InstantiationException ie) {
+		} catch (InstantiationException ie) {
 			throw new ServletException(ie);
-		}
-		catch (IllegalAccessException iae) {
+		} catch (IllegalAccessException iae) {
 			throw new ServletException(iae);
 		}
 	}
@@ -386,9 +403,11 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean, Fi
 	/**
 	 * Does nothing. We use IoC container lifecycle services instead.
 	 * 
-	 * @param filterConfig ignored
+	 * @param filterConfig
+	 *            ignored
 	 * 
-	 * @throws ServletException ignored
+	 * @throws ServletException
+	 *             ignored
 	 */
 	public void init(FilterConfig filterConfig) throws ServletException {
 	}

core/src/test/java/org/acegisecurity/context/HttpSessionContextIntegrationFilterTests.java

@@ -23,6 +23,7 @@ import org.acegisecurity.GrantedAuthorityImpl;
 import org.acegisecurity.MockFilterConfig;
 
 import org.acegisecurity.adapters.PrincipalAcegiUserToken;
+import org.jmock.Mock;
 
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
@@ -36,15 +37,16 @@ import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 
-
 /**
  * Tests {@link HttpSessionContextIntegrationFilter}.
  * 
  * @author Ben Alex
- * @version $Id$
+ * @version $Id: HttpSessionContextIntegrationFilterTests.java 1858 2007-05-24
+ *          02:04:47Z benalex $
  */
 public class HttpSessionContextIntegrationFilterTests extends TestCase {
-    //~ Constructors ===================================================================================================
+	// ~ Constructors
+	// ===================================================================================================
 
 	public HttpSessionContextIntegrationFilterTests() {
 		super();
@@ -54,9 +56,11 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
 		super(arg0);
 	}
 
-    //~ Methods ========================================================================================================
+	// ~ Methods
+	// ========================================================================================================
 
-    private void executeFilterInContainerSimulator(FilterConfig filterConfig, Filter filter, ServletRequest request,
+	private static void executeFilterInContainerSimulator(
+			FilterConfig filterConfig, Filter filter, ServletRequest request,
 			ServletResponse response, FilterChain filterChain)
 			throws ServletException, IOException {
 		filter.init(filterConfig);
@@ -65,11 +69,11 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
 	}
 
 	public static void main(String[] args) {
-        junit.textui.TestRunner.run(HttpSessionContextIntegrationFilterTests.class);
+		junit.textui.TestRunner
+				.run(HttpSessionContextIntegrationFilterTests.class);
 	}
 
-    public void testDetectsIncompatibleSessionProperties()
-        throws Exception {
+	public void testDetectsIncompatibleSessionProperties() throws Exception {
 		HttpSessionContextIntegrationFilter filter = new HttpSessionContextIntegrationFilter();
 
 		try {
@@ -110,8 +114,12 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
 	public void testExceptionWithinFilterChainStillClearsSecurityContextHolder()
 			throws Exception {
 		// Build an Authentication object we simulate came from HttpSession
-        PrincipalAcegiUserToken sessionPrincipal = new PrincipalAcegiUserToken("key", "someone", "password",
-                new GrantedAuthority[] {new GrantedAuthorityImpl("SOME_ROLE")}, null);
+		PrincipalAcegiUserToken sessionPrincipal = new PrincipalAcegiUserToken(
+				"key",
+				"someone",
+				"password",
+				new GrantedAuthority[] { new GrantedAuthorityImpl("SOME_ROLE") },
+				null);
 
 		// Build a Context to store in HttpSession (simulating prior request)
 		SecurityContext sc = new SecurityContextImpl();
@@ -119,10 +127,13 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
 
 		// Build a mock request
 		MockHttpServletRequest request = new MockHttpServletRequest();
-        request.getSession().setAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY, sc);
+		request.getSession().setAttribute(
+				HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY,
+				sc);
 
 		MockHttpServletResponse response = new MockHttpServletResponse();
-        FilterChain chain = new MockFilterChain(sessionPrincipal, null, new IOException());
+		FilterChain chain = new MockFilterChain(sessionPrincipal, null,
+				new IOException());
 
 		// Prepare filter
 		HttpSessionContextIntegrationFilter filter = new HttpSessionContextIntegrationFilter();
@@ -131,26 +142,39 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
 
 		// Execute filter
 		try {
-            executeFilterInContainerSimulator(new MockFilterConfig(), filter, request, response, chain);
+			executeFilterInContainerSimulator(new MockFilterConfig(), filter,
+					request, response, chain);
 			fail("We should have received the IOException thrown inside the filter chain here");
 		} catch (IOException ioe) {
 			assertTrue(true);
 		}
 
-        // Check the SecurityContextHolder is null, even though an exception was thrown during chain
-        assertEquals(new SecurityContextImpl(), SecurityContextHolder.getContext());
-        assertNull("Should have cleared FILTER_APPLIED", request.getAttribute(HttpSessionContextIntegrationFilter.FILTER_APPLIED));
+		// Check the SecurityContextHolder is null, even though an exception was
+		// thrown during chain
+		assertEquals(new SecurityContextImpl(), SecurityContextHolder
+				.getContext());
+		assertNull(
+				"Should have cleared FILTER_APPLIED",
+				request
+						.getAttribute(HttpSessionContextIntegrationFilter.FILTER_APPLIED));
 	}
 
 	public void testExistingContextContentsCopiedIntoContextHolderFromSessionAndChangesToContextCopiedBackToSession()
 			throws Exception {
 		// Build an Authentication object we simulate came from HttpSession
-        PrincipalAcegiUserToken sessionPrincipal = new PrincipalAcegiUserToken("key", "someone", "password",
-                new GrantedAuthority[] {new GrantedAuthorityImpl("SOME_ROLE")}, null);
-
-        // Build an Authentication object we simulate our Authentication changed it to
-        PrincipalAcegiUserToken updatedPrincipal = new PrincipalAcegiUserToken("key", "someone", "password",
-                new GrantedAuthority[] {new GrantedAuthorityImpl("SOME_DIFFERENT_ROLE")}, null);
+		PrincipalAcegiUserToken sessionPrincipal = new PrincipalAcegiUserToken(
+				"key",
+				"someone",
+				"password",
+				new GrantedAuthority[] { new GrantedAuthorityImpl("SOME_ROLE") },
+				null);
+
+		// Build an Authentication object we simulate our Authentication changed
+		// it to
+		PrincipalAcegiUserToken updatedPrincipal = new PrincipalAcegiUserToken(
+				"key", "someone", "password",
+				new GrantedAuthority[] { new GrantedAuthorityImpl(
+						"SOME_DIFFERENT_ROLE") }, null);
 
 		// Build a Context to store in HttpSession (simulating prior request)
 		SecurityContext sc = new SecurityContextImpl();
@@ -158,10 +182,13 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
 
 		// Build a mock request
 		MockHttpServletRequest request = new MockHttpServletRequest();
-        request.getSession().setAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY, sc);
+		request.getSession().setAttribute(
+				HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY,
+				sc);
 
 		MockHttpServletResponse response = new MockHttpServletResponse();
-        FilterChain chain = new MockFilterChain(sessionPrincipal, updatedPrincipal, null);
+		FilterChain chain = new MockFilterChain(sessionPrincipal,
+				updatedPrincipal, null);
 
 		// Prepare filter
 		HttpSessionContextIntegrationFilter filter = new HttpSessionContextIntegrationFilter();
@@ -169,19 +196,26 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
 		filter.afterPropertiesSet();
 
 		// Execute filter
-        executeFilterInContainerSimulator(new MockFilterConfig(), filter, request, response, chain);
+		executeFilterInContainerSimulator(new MockFilterConfig(), filter,
+				request, response, chain);
 
 		// Obtain new/update Authentication from HttpSession
-        SecurityContext context = (SecurityContext) request.getSession()
-                                                           .getAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY);
-        assertEquals(updatedPrincipal, ((SecurityContext) context).getAuthentication());
+		SecurityContext context = (SecurityContext) request
+				.getSession()
+				.getAttribute(
+						HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY);
+		assertEquals(updatedPrincipal, ((SecurityContext) context)
+				.getAuthentication());
 	}
 
 	public void testHttpSessionCreatedWhenContextHolderChanges()
 			throws Exception {
-        // Build an Authentication object we simulate our Authentication changed it to
-        PrincipalAcegiUserToken updatedPrincipal = new PrincipalAcegiUserToken("key", "someone", "password",
-                new GrantedAuthority[] {new GrantedAuthorityImpl("SOME_DIFFERENT_ROLE")}, null);
+		// Build an Authentication object we simulate our Authentication changed
+		// it to
+		PrincipalAcegiUserToken updatedPrincipal = new PrincipalAcegiUserToken(
+				"key", "someone", "password",
+				new GrantedAuthority[] { new GrantedAuthorityImpl(
+						"SOME_DIFFERENT_ROLE") }, null);
 
 		// Build a mock request
 		MockHttpServletRequest request = new MockHttpServletRequest();
@@ -191,20 +225,24 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
 		// Prepare filter
 		HttpSessionContextIntegrationFilter filter = new HttpSessionContextIntegrationFilter();
 		filter.setContext(SecurityContextImpl.class);
-        // don't call afterPropertiesSet to test case when not instantiated by Spring 
+		// don't call afterPropertiesSet to test case when not instantiated by
+		// Spring
 		// filter.afterPropertiesSet();
 
 		// Execute filter
-        executeFilterInContainerSimulator(new MockFilterConfig(), filter, request, response, chain);
+		executeFilterInContainerSimulator(new MockFilterConfig(), filter,
+				request, response, chain);
 
 		// Obtain new/updated Authentication from HttpSession
-        SecurityContext context = (SecurityContext) request.getSession(false)
-                                                           .getAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY);
-        assertEquals(updatedPrincipal, ((SecurityContext) context).getAuthentication());
+		SecurityContext context = (SecurityContext) request
+				.getSession(false)
+				.getAttribute(
+						HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY);
+		assertEquals(updatedPrincipal, ((SecurityContext) context)
+				.getAuthentication());
 	}
 
-    public void testHttpSessionEagerlyCreatedWhenDirected()
-        throws Exception {
+	public void testHttpSessionEagerlyCreatedWhenDirected() throws Exception {
 		// Build a mock request
 		MockHttpServletRequest request = new MockHttpServletRequest(null, null);
 		MockHttpServletResponse response = new MockHttpServletResponse();
@@ -217,7 +255,8 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
 		filter.afterPropertiesSet();
 
 		// Execute filter
-        executeFilterInContainerSimulator(new MockFilterConfig(), filter, request, response, chain);
+		executeFilterInContainerSimulator(new MockFilterConfig(), filter,
+				request, response, chain);
 
 		// Check the session is not null
 		assertNotNull(request.getSession(false));
@@ -236,7 +275,8 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
 		filter.afterPropertiesSet();
 
 		// Execute filter
-        executeFilterInContainerSimulator(new MockFilterConfig(), filter, request, response, chain);
+		executeFilterInContainerSimulator(new MockFilterConfig(), filter,
+				request, response, chain);
 
 		// Check the session is null
 		assertNull(request.getSession(false));
@@ -244,14 +284,18 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
 
 	public void testHttpSessionWithNonContextInWellKnownLocationIsOverwritten()
 			throws Exception {
-        // Build an Authentication object we simulate our Authentication changed it to
-        PrincipalAcegiUserToken updatedPrincipal = new PrincipalAcegiUserToken("key", "someone", "password",
-                new GrantedAuthority[] {new GrantedAuthorityImpl("SOME_DIFFERENT_ROLE")}, null);
+		// Build an Authentication object we simulate our Authentication changed
+		// it to
+		PrincipalAcegiUserToken updatedPrincipal = new PrincipalAcegiUserToken(
+				"key", "someone", "password",
+				new GrantedAuthority[] { new GrantedAuthorityImpl(
+						"SOME_DIFFERENT_ROLE") }, null);
 
 		// Build a mock request
 		MockHttpServletRequest request = new MockHttpServletRequest();
-        request.getSession()
-               .setAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY, "NOT_A_CONTEXT_OBJECT");
+		request.getSession().setAttribute(
+				HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY,
+				"NOT_A_CONTEXT_OBJECT");
 
 		MockHttpServletResponse response = new MockHttpServletResponse();
 		FilterChain chain = new MockFilterChain(null, updatedPrincipal, null);
@@ -262,34 +306,75 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
 		filter.afterPropertiesSet();
 
 		// Execute filter
-        executeFilterInContainerSimulator(new MockFilterConfig(), filter, request, response, chain);
+		executeFilterInContainerSimulator(new MockFilterConfig(), filter,
+				request, response, chain);
 
 		// Obtain new/update Authentication from HttpSession
-        SecurityContext context = (SecurityContext) request.getSession()
-                                                           .getAttribute(HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY);
-        assertEquals(updatedPrincipal, ((SecurityContext) context).getAuthentication());
+		SecurityContext context = (SecurityContext) request
+				.getSession()
+				.getAttribute(
+						HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY);
+		assertEquals(updatedPrincipal, ((SecurityContext) context)
+				.getAuthentication());
 	}
 
-    //~ Inner Classes ==================================================================================================
+	public void testConcurrentThreadsLazilyChangeFilterAppliedValueToTrue()
+			throws Exception {
+		PrincipalAcegiUserToken sessionPrincipal = new PrincipalAcegiUserToken(
+				"key",
+				"someone",
+				"password",
+				new GrantedAuthority[] { new GrantedAuthorityImpl("SOME_ROLE") },
+				null);
+
+		// Build a Context to store in HttpSession (simulating prior request)
+		SecurityContext sc = new SecurityContextImpl();
+		sc.setAuthentication(sessionPrincipal);
+
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.getSession().setAttribute(
+				HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY,
+				sc);
+		MockHttpServletResponse response = new MockHttpServletResponse();
+
+		// Prepare filter
+		HttpSessionContextIntegrationFilter filter = new HttpSessionContextIntegrationFilter();
+		filter.setContext(SecurityContextImpl.class);
+		filter.afterPropertiesSet();
+
+		for (int i = 0; i < 3; i++) {
+			ThreadRunner runner = new ThreadRunner(request, response, filter,
+					new MockFilterChain(sessionPrincipal, null, null));
+			runner.start();
+		}
+
+	}
+
+	// ~ Inner Classes
+	// ==================================================================================================
 
 	private class MockFilterChain extends TestCase implements FilterChain {
 		private Authentication changeContextHolder;
 		private Authentication expectedOnContextHolder;
 		private IOException toThrowDuringChain;
 
-        public MockFilterChain(Authentication expectedOnContextHolder, Authentication changeContextHolder,
+		public MockFilterChain(Authentication expectedOnContextHolder,
+				Authentication changeContextHolder,
 				IOException toThrowDuringChain) {
 			this.expectedOnContextHolder = expectedOnContextHolder;
 			this.changeContextHolder = changeContextHolder;
 			this.toThrowDuringChain = toThrowDuringChain;
 		}
 
-        private MockFilterChain() {}
+		private MockFilterChain() {
+		}
 
 		public void doFilter(ServletRequest arg0, ServletResponse arg1)
 				throws IOException, ServletException {
+
 			if (expectedOnContextHolder != null) {
-                assertEquals(expectedOnContextHolder, SecurityContextHolder.getContext().getAuthentication());
+				assertEquals(expectedOnContextHolder, SecurityContextHolder
+						.getContext().getAuthentication());
 			}
 
 			if (changeContextHolder != null) {
@@ -301,6 +386,38 @@ public class HttpSessionContextIntegrationFilterTests extends TestCase {
 			if (toThrowDuringChain != null) {
 				throw toThrowDuringChain;
 			}
+
+		}
+	}
+
+	private static class ThreadRunner extends Thread {
+		private MockHttpServletRequest request;
+		private MockHttpServletResponse response;
+		private HttpSessionContextIntegrationFilter filter;
+		private MockFilterChain chain;
+
+		public ThreadRunner(MockHttpServletRequest request,
+				MockHttpServletResponse response,
+				HttpSessionContextIntegrationFilter filter,
+				MockFilterChain chain) {
+			this.request = request;
+			this.response = response;
+			this.filter = filter;
+			this.chain = chain;
+		}
+
+		public void run() {
+			try {
+				// Execute filter
+				executeFilterInContainerSimulator(new MockFilterConfig(),
+						filter, request, response, chain);
+
+				// Check the session is not null
+				assertNotNull(request.getSession(false));
+			} catch (Exception e) {
+				e.printStackTrace();
 			}
 		}
+
+	}
 }