Spring/spring-session-data-mongodb
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

CookieHttpSessionStrategy only writes same Session once

Browse Source 
If SessionRepositoryRequestWrapper.commitSession() is invoked twice
when a new session is created, then CookieHttpSessionStrategy will
add the same cookie twice. A couple examples of how this could happen:

* The response is committed and
  SessionRepositoryResponseWrapper.onResponseCommitted() invokes
  SessionRepositoryRequestWrapper.commitSession(). Then the finally
  block in SessionRepositoryFilter invokes
  SessionRepositoryRequestWrapper.commitSession() again.
* The new session is initialized and an Exception is thrown (i.e.
  gh-229). The SessionRepositoryFilter invokes
  SessionRepositoryRequestWrapper.commitSession() in the REQUEST
  dispatch. Then in the ERROR dispatch SessionRepositoryFilter invokes
  SessionRepositoryRequestWrapper.commitSession() invokes it again.

This commit ensures if the same Session is passed into
CookieHttpSessionStrategy multiple times within the same HttpServletRequest
it is only written once by keeping track of the sessions on a request
attribute.

Fixes gh-251
This commit is contained in:
Rob Winch
2015-07-28 14:58:51 -05:00
parent 3d93f2cf56
commit d5484e15ca
2 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
spring-session/src/test/java/org/springframework/session/web/http/CookieHttpSessionStrategyTests.java
View File

@@ -68,6 +68,28 @@ public class CookieHttpSessionStrategyTests {
assertThat(getSessionId()).isEqualTo(session.getId());
}
@Test
public void onNewSessionTwiceSameId() throws Exception {
strategy.onNewSession(session, request, response);
strategy.onNewSession(session, request, response);
assertThat(response.getCookies()).hasSize(1);
}
@Test
public void onNewSessionTwiceNewId() throws Exception {
Session newSession = new MapSession();
strategy.onNewSession(session, request, response);
strategy.onNewSession(newSession, request, response);
Cookie[] cookies = response.getCookies();
assertThat(cookies).hasSize(2);
assertThat(cookies[0].getValue()).isEqualTo(session.getId());
assertThat(cookies[1].getValue()).isEqualTo(newSession.getId());
}
@Test
public void onNewSessionExistingSessionSameAlias() throws Exception {
Session existing = new MapSession();