From 971a2d17d95989ff2420f9e7b49896e01ba2234d Mon Sep 17 00:00:00 2001 From: Eleftheria Stein Date: Tue, 20 Jul 2021 10:00:53 +0200 Subject: [PATCH] Set cookie path to context path without trailing slash Closes gh-1863 --- .../session/web/http/DefaultCookieSerializer.java | 5 +++-- .../session/web/http/CookieHttpSessionIdResolverTests.java | 6 +++--- .../session/web/http/DefaultCookieSerializerTests.java | 6 +++--- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/spring-session-core/src/main/java/org/springframework/session/web/http/DefaultCookieSerializer.java b/spring-session-core/src/main/java/org/springframework/session/web/http/DefaultCookieSerializer.java index 64420ad0..13471204 100644 --- a/spring-session-core/src/main/java/org/springframework/session/web/http/DefaultCookieSerializer.java +++ b/spring-session-core/src/main/java/org/springframework/session/web/http/DefaultCookieSerializer.java @@ -1,5 +1,5 @@ /* - * Copyright 2014-2019 the original author or authors. + * Copyright 2014-2021 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -432,7 +432,8 @@ public class DefaultCookieSerializer implements CookieSerializer { private String getCookiePath(HttpServletRequest request) { if (this.cookiePath == null) { - return request.getContextPath() + "/"; + String contextPath = request.getContextPath(); + return (contextPath != null && contextPath.length() > 0) ? contextPath : "/"; } return this.cookiePath; } diff --git a/spring-session-core/src/test/java/org/springframework/session/web/http/CookieHttpSessionIdResolverTests.java b/spring-session-core/src/test/java/org/springframework/session/web/http/CookieHttpSessionIdResolverTests.java index 87fdf54a..b75eb8d0 100644 --- a/spring-session-core/src/test/java/org/springframework/session/web/http/CookieHttpSessionIdResolverTests.java +++ b/spring-session-core/src/test/java/org/springframework/session/web/http/CookieHttpSessionIdResolverTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2014-2019 the original author or authors. + * Copyright 2014-2021 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -109,7 +109,7 @@ class CookieHttpSessionIdResolverTests { this.strategy.setSessionId(this.request, this.response, this.session.getId()); Cookie sessionCookie = this.response.getCookie(this.cookieName); - assertThat(sessionCookie.getPath()).isEqualTo(this.request.getContextPath() + "/"); + assertThat(sessionCookie.getPath()).isEqualTo(this.request.getContextPath()); } @Test @@ -131,7 +131,7 @@ class CookieHttpSessionIdResolverTests { this.strategy.expireSession(this.request, this.response); Cookie sessionCookie = this.response.getCookie(this.cookieName); - assertThat(sessionCookie.getPath()).isEqualTo(this.request.getContextPath() + "/"); + assertThat(sessionCookie.getPath()).isEqualTo(this.request.getContextPath()); } @Test diff --git a/spring-session-core/src/test/java/org/springframework/session/web/http/DefaultCookieSerializerTests.java b/spring-session-core/src/test/java/org/springframework/session/web/http/DefaultCookieSerializerTests.java index 1a9a3835..ce488034 100644 --- a/spring-session-core/src/test/java/org/springframework/session/web/http/DefaultCookieSerializerTests.java +++ b/spring-session-core/src/test/java/org/springframework/session/web/http/DefaultCookieSerializerTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2014-2019 the original author or authors. + * Copyright 2014-2021 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -267,7 +267,7 @@ class DefaultCookieSerializerTests { void writeCookieCookiePathDefaultContextPathUsed() { this.request.setContextPath("/context"); this.serializer.writeCookieValue(cookieValue(this.sessionId)); - assertThat(getCookie().getPath()).isEqualTo("/context/"); + assertThat(getCookie().getPath()).isEqualTo("/context"); } @Test @@ -275,7 +275,7 @@ class DefaultCookieSerializerTests { this.request.setContextPath("/context"); this.serializer.setCookiePath(null); this.serializer.writeCookieValue(cookieValue(this.sessionId)); - assertThat(getCookie().getPath()).isEqualTo("/context/"); + assertThat(getCookie().getPath()).isEqualTo("/context"); } @Test