title: Spring Security Authentication object is null for Spring SseEmitter
body: <p>I have a Spring Controller method that invokes an SseEmitter to push server-sent events to browser. From the browser, javascript to create EventSource for the SSE url is run from the homepage. The homepage itself needs authentication that is done using Spring Security Form-based authentication. So a login page, on successful authentication, will direct to the home-page.However the authentication object is <strong>null</strong> in the Server-sent events method. I understand my incorrect Spring Security configuration is causing this but don't know how to fix it!!</p>
  
  <p>Below is the security configuration I used</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class UCFSecurityConfig extends WebSecurityConfigurerAdapter{
  
  @Autowired
  @Qualifier("epUser")
  private UserDetailsService userDetailsService;
  
  @Autowired
  private AuthenticationSuccessHandler successHandler;
  ....
  ....
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http
          .authorizeRequests()
              .antMatchers("/rest/**").authenticated()
              .anyRequest().authenticated()
              .and()
              .formLogin()
              .loginPage("/login.htm").failureUrl("/error.htm")
              .loginProcessingUrl("/spring_sec_auth.htm")
              .usernameParameter("username").passwordParameter("password").permitAll()
              .successHandler(successHandler)
              .and()
              .logout()
              //.logoutSuccessUrl("/login.htm?logout")
              .invalidateHttpSession(true)
              .and().csrf().disable();
  
  }
  ....
  ....
  } 
  </code></pre>
  
  <blockquote>
    <p>The SSE method below calls <code>userActivityFeed()</code> in
    <code>UserActivityService</code> which uses Authentication object from <code>SecurityContextHolder.getContext().getAuthentication()</code> which throws an <strong>NPE</strong>!!!</p>
  </blockquote>
  
  <pre><code>@Controller
  public class UserActivityController {
  
  @Autowired
  private UserActivityService userActivityService;
  
  @RequestMapping("/userActivity")
  public ResponseBodyEmitter  activityFeed() {
  
      final SseEmitter emitter = new SseEmitter();
      ExecutorService service = Executors.newSingleThreadExecutor();
      service.execute(() -&gt; {
         try {
              emitter.send(userActivityService.userActivityFeed() , MediaType.TEXT_PLAIN);
              Thread.sleep(UCFConstants.USR_ACTV_REFRESH_PERIOD);
  
          } catch (Exception e) {
              e.printStackTrace();
              emitter.completeWithError(e);
              return;
          }
          emitter.complete();
      });
      service.shutdown();
      return emitter;
    }
  }
  </code></pre>
  
  <p>Javascript to create SSE EventSource object</p>
  
  <pre><code>&lt;script type="text/javascript"&gt;
   var source = new EventSource("/MyApp/rest/userActivity");
   source.onmessage = function(event) {
                     document.getElementById("result").innerHTML += event.data                
                     + "&lt;br&gt;";
                     };
    &lt;/script&gt;
  </code></pre>
  
  <p>My application web.xml </p>
  
  <pre><code> &lt;servlet-mapping&gt;
     &lt;servlet-name&gt;MyApp&lt;/servlet-name&gt;
     &lt;url-pattern&gt;*.htm&lt;/url-pattern&gt;
   &lt;/servlet-mapping&gt;
   &lt;servlet-mapping&gt;
     &lt;servlet-name&gt;MyApp&lt;/servlet-name&gt;
     &lt;url-pattern&gt;/rest/*&lt;/url-pattern&gt;
   &lt;/servlet-mapping&gt;
  </code></pre>