[SLING-11974] Regression caused by SLING-11825 - change in request getUserPrincipal

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Engine 2.14.0, Engine 2.15.0, Engine 2.15.2
• Fix Version/s: Engine 2.15.4, API 2.27.6
• Component/s: Engine
• Assignee: Carsten Ziegeler
• Reporter: Carsten Ziegeler
• Created: 20/Jul/23 09:30
• Updated: 13/Jun/24 19:26
• Resolved: 20/Jul/23 09:39

Description

With SLING-11825 getUserPrincipal will always return null for the anonymous user. While this change is spec compliant it is a change in behaviour which is actually breaking users of Sling.
Therefore we should revert that change and add a switch to toggle the behaviour. By default, the switch will be set to enable the old, non spec compliant behaviour.
In general, it is suggest to use request getAuthType() == null to check whether the request is authenticated - and only if that returns a non null value call getUserPrincipal

Issue Links

• is broken by: SLING-11825 SlingHttpServletRequestImpl.getUserPrincipal() does not return null for anonymous requests