Luke Taylor 6d6c2d31ef SEC-1462: Only apply session fixation protection strategy if request.isRequestedSessionIdValid() returns true. We don't need to create a new session if the current one already has a different Id from the client.

2010-04-20 18:04:56 +01:00

..

main/java/org/springframework/security/web

SEC-1462: Only apply session fixation protection strategy if request.isRequestedSessionIdValid() returns true. We don't need to create a new session if the current one already has a different Id from the client.

2010-04-20 18:04:56 +01:00

test

SEC-1429: Fix test. Wasn't setting allowSessionCreation=false on failure handler.

2010-03-11 02:30:37 +00:00