Currently, Session#getAttributeNames implementations, by delegating to MapSession, all return a session attribute map's key set. This causes ConcurrentModificationException when an attempt to modify session attributes is made while iterating over the returned attribute names.
Closes gh-1120
Previously, invoking HttpServletRequest#changeSessionId on session backed by HazelcastSessionRepository generated generated invalid session destroyed and session created events. This was due to use of IMap#remove and IMap#set when handling the change session id.
This commit improves change session id handling to prevent publishing invalid events by using IMap#delete instead of IMap#remove and keeping track of originally assigned session id.
Closes gh-1077
This commit removes constructor that takes session id instead of session object for the entire `AbstractSessionEvent` hierarchy.
The ability to create `AbstractSessionEvent` instances with no underlying session object leads to NPE when interacting with `HttpSession` obtained from `HttpSessionEvent`.
See gh-499
Closes gh-939
This commit simplifies `HttpSessionStrategy` API by aligning it with Spring Framework's `WebSessionIdResolver`. As a part of this, support for managing multiple users' sessions has been removed.
Closes gh-275
Closes gh-362
This commit removes the default `MapReactorSessionRepository` so that the users are required to explicitly supply the `Map` used to store the sessions.
This commit removes the default `MapSessionRepository` constructor so that the users are required to explicitly supply the `Map` used to store the sessions.
This commit improves dependency management with the following changes:
- `spring-session-core`: move `javax.servlet-api` from `provided` to `optional` configuration due to introduction of reactive support
- `spring-session-data-redis`: remove Redis driver from `compile` configuration
- Boot samples: delegate Redis driver choice to `spring-boot-starter-data-redis`
- polish `test` configuration dependencies
