title: Accessing RequestContextHolder and HttpServletRequest.getUserPrincipal() from AuthenticationSuccessHandler
body: <p>I have a Spring-MVC application (i.e. I am using the Spring's dispatcher servlet). I am also using Spring Security to authenticate users. Since I use the Spring's dispatcher servlet, I do NOT have to declare</p>
  
  <pre><code>  &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.request.RequestContextListener&lt;/listener-class&gt;
    &lt;/listener&gt;
  </code></pre>
  
  <p>in my web.xml in order to be able to use <code>RequestContextHolder</code> (if I understand correctly the documentation).</p>
  
  <p>My question refers to my implementation of the interface <code>org.springframework.security.web.authentication.AuthenticationSuccessHandler</code>:</p>
  
  <pre><code>public class AuthenticationSuccessHandlerImpl implements AuthenticationSuccessHandler {
  
      @Override
      public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws ServletException, IOException {
  
          int timeout = 60*60;
  
          //does work
          request.getSession().setMaxInactiveInterval(timeout); //60 minutes
          System.out.println("Session timeout of user: " + authentication.getName() + " has been set to: " + timeout + " seconds.");
  
          /*
          //does not work
          session().setMaxInactiveInterval(timeout); //60 minutes
          System.out.println("Session timeout of user: " + request.getUserPrincipal().getName() + " has been set to: " + timeout + " seconds.");
          */
  
          //now restore the default work flow (SavedRequestAwareAuthenticationSuccessHandler is the default AuthenticationSuccessHandler that Spring uses,
          // see: http://static.springsource.org/spring-security/site/docs/3.0.x/reference/core-web-filters.html#form-login-flow-handling )
          (new SavedRequestAwareAuthenticationSuccessHandler()).onAuthenticationSuccess(request, response, authentication);
      }
  
      public static HttpSession session() {
          ServletRequestAttributes attr = (ServletRequestAttributes) RequestContextHolder.currentRequestAttributes();
          return attr.getRequest().getSession(true); // true == allow create
      }
  }
  </code></pre>
  
  <p><strong>Could you explain why</strong> in the above mentioned code, <code>RequestContextHolder.currentRequestAttributes()</code> and <code>HttpServletRequest.getUserPrincipal()</code> do not work (they do work inside a Controller)?</p>
  
  <p>Thanks!</p>