371162 NPE protection for nested security handlers

1 files changed, 10 insertions, 7 deletions

diff --git a/jetty-security/src/main/java/org/eclipse/jetty/security/SecurityHandler.java b/jetty-security/src/main/java/org/eclipse/jetty/security/SecurityHandler.java
index f6af097880..d6f69bbb91 100644
--- a/jetty-security/src/main/java/org/eclipse/jetty/security/SecurityHandler.java
+++ b/jetty-security/src/main/java/org/eclipse/jetty/security/SecurityHandler.java
@@ -503,15 +503,18 @@ public abstract class SecurityHandler extends HandlerWrapper implements Authenti
                         previousIdentity = deferred.getPreviousAssociation();
                         deferred.setIdentityService(null);
                     }
-                   
-                    Authentication auth=baseRequest.getAuthentication();
-                    if (auth instanceof Authentication.User)
+
+                    if (authenticator!=null)
                     {
-                        Authentication.User userAuth = (Authentication.User)auth;
-                        authenticator.secureResponse(request, response, isAuthMandatory, userAuth);
+                        Authentication auth=baseRequest.getAuthentication();
+                        if (auth instanceof Authentication.User)
+                        {
+                            Authentication.User userAuth = (Authentication.User)auth;
+                            authenticator.secureResponse(request, response, isAuthMandatory, userAuth);
+                        }
+                        else
+                            authenticator.secureResponse(request, response, isAuthMandatory, null);
                     }
-                    else
-                        authenticator.secureResponse(request, response, isAuthMandatory, null);
                 }
                 else
                 {