Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Transfer session's max inactive interval

Browse Source 
Fixes: gh-2693
This commit is contained in:
Venkata Jaswanth U
2018-06-14 17:51:43 +10:00
committed by Eleftheria Stein
parent 3b80c2e345
commit 02b7d04027
2 changed files with 83 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
web/src/main/java/org/springframework/security/web/authentication/session/SessionFixationProtectionStrategy.java
View File

@@ -90,6 +90,7 @@ public class SessionFixationProtectionStrategy extends
}
Map<String, Object> attributesToMigrate = extractAttributes(session);
int originMaxInactiveInterval = session.getMaxInactiveInterval();
session.invalidate();
session = request.getSession(true); // we now have a new session
@@ -99,6 +100,7 @@ public class SessionFixationProtectionStrategy extends
}
transferAttributes(attributesToMigrate, session);
session.setMaxInactiveInterval(originMaxInactiveInterval);
return session;
}