From 8bd437490955467a0839a14b5c2be784c7ce3535 Mon Sep 17 00:00:00 2001 From: Eleftheria Stein Date: Thu, 25 Mar 2021 09:27:27 +0200 Subject: [PATCH] Throw exception if session created after response Closes gh-1798 --- .../session/web/http/SessionRepositoryFilter.java | 4 ++++ .../web/http/SessionRepositoryFilterTests.java | 12 ++++++++++++ 2 files changed, 16 insertions(+) diff --git a/spring-session-core/src/main/java/org/springframework/session/web/http/SessionRepositoryFilter.java b/spring-session-core/src/main/java/org/springframework/session/web/http/SessionRepositoryFilter.java index d9a84610..b8e89306 100644 --- a/spring-session-core/src/main/java/org/springframework/session/web/http/SessionRepositoryFilter.java +++ b/spring-session-core/src/main/java/org/springframework/session/web/http/SessionRepositoryFilter.java @@ -310,6 +310,10 @@ public class SessionRepositoryFilter extends OncePerRequestFi if (!create) { return null; } + if (SessionRepositoryFilter.this.httpSessionIdResolver instanceof CookieHttpSessionIdResolver + && this.response.isCommitted()) { + throw new IllegalArgumentException("Cannot create a session after the response has been committed"); + } if (SESSION_LOGGER.isDebugEnabled()) { SESSION_LOGGER.debug( "A new session was created. To help you troubleshoot where the session was created we provided a StackTrace (this is not an error). You can prevent this from appearing by disabling DEBUG logging for " diff --git a/spring-session-core/src/test/java/org/springframework/session/web/http/SessionRepositoryFilterTests.java b/spring-session-core/src/test/java/org/springframework/session/web/http/SessionRepositoryFilterTests.java index 7b2be324..77289632 100644 --- a/spring-session-core/src/test/java/org/springframework/session/web/http/SessionRepositoryFilterTests.java +++ b/spring-session-core/src/test/java/org/springframework/session/web/http/SessionRepositoryFilterTests.java @@ -423,6 +423,18 @@ class SessionRepositoryFilterTests { assertThat(this.response.getCookie("SESSION")).isNotNull(); } + @Test + void doFilterGetSessionNewWhenResponseCommittedThenException() { + assertThatIllegalArgumentException().isThrownBy(() -> doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) + throws IOException { + wrappedResponse.getWriter().flush(); + wrappedRequest.getSession(); + } + })); + } + @Test void doFilterGetSessionNew() throws Exception { doFilter(new DoInFilter() {