Remove Servlet 2.5 Support for Session Fixation

This commit removes existence validation of a method only available in Servlet 3.1.
Spring Framework baseline is Servlet 3.1 so is not longer required.

Fixes: gh-6259

web/src/main/java/org/springframework/security/web/authentication/session/ChangeSessionIdAuthenticationStrategy.java

@@ -15,33 +15,18 @@
  */
 package org.springframework.security.web.authentication.session;
 
-import java.lang.reflect.Method;
-
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpSession;
 
-import org.springframework.util.ReflectionUtils;
-
 /**
  * Uses {@code HttpServletRequest.changeSessionId()} to protect against session fixation
- * attacks. This is the default implementation for Servlet 3.1+.
+ * attacks. This is the default implementation.
  *
  * @author Rob Winch
  * @since 3.2
  */
 public final class ChangeSessionIdAuthenticationStrategy
 		extends AbstractSessionFixationProtectionStrategy {
-	private final Method changeSessionIdMethod;
-
-	public ChangeSessionIdAuthenticationStrategy() {
-		Method changeSessionIdMethod = ReflectionUtils
-				.findMethod(HttpServletRequest.class, "changeSessionId");
-		if (changeSessionIdMethod == null) {
-			throw new IllegalStateException(
-					"HttpServletRequest.changeSessionId is undefined. Are you using a Servlet 3.1+ environment?");
-		}
-		this.changeSessionIdMethod = changeSessionIdMethod;
-	}
 
 	/*
 	 * (non-Javadoc)
@@ -52,7 +37,7 @@ public final class ChangeSessionIdAuthenticationStrategy
 	 */
 	@Override
 	HttpSession applySessionFixation(HttpServletRequest request) {
-		ReflectionUtils.invokeMethod(this.changeSessionIdMethod, request);
+		request.changeSessionId();
 		return request.getSession();
 	}
 }

web/src/main/java/org/springframework/security/web/authentication/session/SessionFixationProtectionStrategy.java

@@ -24,7 +24,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpSession;
 
 /**
- * The default implementation of {@link SessionAuthenticationStrategy} when using <
+ * The implementation of {@link SessionAuthenticationStrategy} when using <
  * Servlet 3.1.
  * <p>
  * Creates a new session for the newly authenticated user if they already have a session