Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-689: Further tests, logging improvements.

Browse Source
This commit is contained in:
Luke Taylor
2008-03-26 00:00:56 +00:00
parent a29842a467
commit 2af2f299cb
3 changed files with 53 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
core/src/main/java/org/springframework/security/ui/SessionFixationProtectionFilter.java
View File

@@ -99,13 +99,16 @@ public class SessionFixationProtectionFilter extends SpringSecurityFilter {
/**
* Response wrapper to handle the situation where we need to migrate the session after a redirect or sendError.
* Similar in function to Martin Algesten's OnRedirectUpdateSessionResponseWrapper used in
* HttpSessionContextIntegrationFilter.
* HttpSessionContextIntegrationFilter.
* <p>
* Only used to wrap the response if the conditions are right at the start of the request to potentially
* require starting a new session, i.e. that the user isn't authenticated and a session existed to begin with.
*/
private class SessionFixationProtectionResponseWrapper extends HttpServletResponseWrapper {
class SessionFixationProtectionResponseWrapper extends HttpServletResponseWrapper {
private HttpServletRequest request;
private boolean newSessionStarted;
public SessionFixationProtectionResponseWrapper(HttpServletResponse response, HttpServletRequest request) {
SessionFixationProtectionResponseWrapper(HttpServletResponse response, HttpServletRequest request) {
super(response);
this.request = request;
}
@@ -148,9 +151,8 @@ public class SessionFixationProtectionFilter extends SpringSecurityFilter {
newSessionStarted = true;
}
private boolean isNewSessionStarted() {
boolean isNewSessionStarted() {
return newSessionStarted;
}
}
}
}

6
core/src/main/java/org/springframework/security/util/SessionUtils.java
View File

@@ -36,7 +36,7 @@ public final class SessionUtils {
String originalSessionId = session.getId();
if (logger.isDebugEnabled()) {
logger.debug("Invalidating session " + (migrateAttributes ? "and" : "without") + " migrating attributes.");
logger.debug("Invalidating session with Id '" + originalSessionId +"' " + (migrateAttributes ? "and" : "without") + " migrating attributes.");
}
HashMap attributesToMigrate = null;
@@ -55,6 +55,10 @@ public final class SessionUtils {
session.invalidate();
session = request.getSession(true); // we now have a new session
if (logger.isDebugEnabled()) {
logger.debug("Started new session: " + session.getId());
}
if (attributesToMigrate != null) {
Iterator iter = attributesToMigrate.entrySet().iterator();