How do I lazy load Spring Security?

Question

How do I not instantiate Spring Security until I need to?

I'm using Google App Engine so the startup time of my web app is important. Sometimes when a user requests a page, they must wait the whole time for my web app instantiate before getting a response (this is called a loading request).

Certain pages of my app require no authentication. For these pages, if the request is a loading request, I don't want the user to have to wait the extra ~1.5 seconds for Spring Security to instantiate.

I've already figured out how to lazy load all of the other components of my app, Spring Security is the only one I don't know how. Anyone have an idea?

EDIT: If anyone knows how to instantiate Spring Security from code instead of using applicationContext-security.xml, then I think I could figure out how to lazy load it.

Answer 1

Well, I finally figured it out. I had to subclass org.springframework.web.context.ContextLoaderListener and org.springframework.web.filter.DelegatingFilterProxy to not do anything until I call an activate method on them.

Answer 2

The hack described here worked for me:

...you can solve this issue with any LazyInitTargetSource for the UserDetailsService.

<bean id="userDetailsService" class="org.springframework.aop.framework.ProxyFactoryBean">
    <property name="targetSource">
        <bean class="org.springframework.aop.target.LazyInitTargetSource">
            <property name="targetBeanName" value="targetUserDetailsService"/>
        </bean>
    </property>
</bean>

<bean id="targetUserDetailsService" class="MyCustomUserService" lazy-init="true">
    ....
</bean>

Answer 3

You can configure <url-pattern>s of Spring Security filter mapping in web.xml to match the secured resources only (as well as login-logout pages and other resources which require the Spring Security processing), and wrap the default filter with your own lazy wrapper, as you did with DispatcherServlet.

EDIT: The problem seems to be more complex than I thought. You can also try to define your security xml as <beans default-lazy-init="true" ...>