root
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Actions 11 Packages Projects Releases Wiki Activity

SEC-3070: Logout invalidate-session=false and Spring Session doesn't 

work
This commit is contained in:
Rob Winch 2015-10-20 14:58:57 -05:00
parent 3925ed90c4
commit cda6532c43
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java
View File

@ -337,7 +337,7 @@ public class HttpSessionSecurityContextRepository implements SecurityContextRepo
logger.debug("SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession."); logger.debug("SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.");
} }
if (httpSession != null && !contextObject.equals(contextBeforeExecution)) { if (httpSession != null && authBeforeExecution != null) {
// SEC-1587 A non-anonymous context may still be in the session // SEC-1587 A non-anonymous context may still be in the session
// SEC-1735 remove if the contextBeforeExecution was not anonymous // SEC-1735 remove if the contextBeforeExecution was not anonymous
httpSession.removeAttribute(springSecurityContextKey); httpSession.removeAttribute(springSecurityContextKey);

18
web/src/test/java/org/springframework/security/web/context/HttpSessionSecurityContextRepositoryTests.java
View File

@ -501,6 +501,24 @@ public class HttpSessionSecurityContextRepositoryTests {
request.getSession().getAttribute(SPRING_SECURITY_CONTEXT_KEY)); request.getSession().getAttribute(SPRING_SECURITY_CONTEXT_KEY));
} }
// SEC-3070
@Test
public void logoutInvalidateSessionFalseFails() throws Exception {
HttpSessionSecurityContextRepository repo = new HttpSessionSecurityContextRepository();
MockHttpServletRequest request = new MockHttpServletRequest();
SecurityContext ctxInSession = SecurityContextHolder.createEmptyContext();
ctxInSession.setAuthentication(testToken);
request.getSession().setAttribute(SPRING_SECURITY_CONTEXT_KEY, ctxInSession);
HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request, new MockHttpServletResponse());
repo.loadContext(holder);
ctxInSession.setAuthentication(null);
repo.saveContext(ctxInSession, holder.getRequest(), holder.getResponse());
assertNull(request.getSession().getAttribute(SPRING_SECURITY_CONTEXT_KEY));
}
@Test @Test
@SuppressWarnings("deprecation") @SuppressWarnings("deprecation")
public void sessionDisableUrlRewritingPreventsSessionIdBeingWrittenToUrl() public void sessionDisableUrlRewritingPreventsSessionIdBeingWrittenToUrl()