Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Set maxAge correctly when expiring WebSession

Browse Source 
Closes gh-31214
This commit is contained in:
rstoyanchev
2023-11-06 11:44:51 +00:00
parent 5df6e8825d
commit 5c012bbb0c
2 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
spring-web/src/main/java/org/springframework/web/server/session/CookieWebSessionIdResolver.java
View File

@@ -105,20 +105,20 @@ public class CookieWebSessionIdResolver implements WebSessionIdResolver {
@Override
public void setSessionId(ServerWebExchange exchange, String id) {
Assert.notNull(id, "'id' is required");
ResponseCookie cookie = initSessionCookie(exchange, id, getCookieMaxAge());
ResponseCookie cookie = initCookie(exchange, id).build();
exchange.getResponse().getCookies().set(this.cookieName, cookie);
}
@Override
public void expireSession(ServerWebExchange exchange) {
ResponseCookie cookie = initSessionCookie(exchange, "", Duration.ZERO);
ResponseCookie cookie = initCookie(exchange, "").maxAge(0).build();
exchange.getResponse().getCookies().set(this.cookieName, cookie);
}
private ResponseCookie initSessionCookie(ServerWebExchange exchange, String id, Duration maxAge) {
private ResponseCookie.ResponseCookieBuilder initCookie(ServerWebExchange exchange, String id) {
ResponseCookie.ResponseCookieBuilder builder = ResponseCookie.from(this.cookieName, id)
.path(exchange.getRequest().getPath().contextPath().value() + "/")
.maxAge(maxAge)
.maxAge(getCookieMaxAge())
.httpOnly(true)
.secure("https".equalsIgnoreCase(exchange.getRequest().getURI().getScheme()))
.sameSite("Lax");
@@ -127,7 +127,7 @@ public class CookieWebSessionIdResolver implements WebSessionIdResolver {
this.initializer.accept(builder);
}
return builder.build();
return builder;
}
}