root
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Actions 5 Packages Projects Releases Wiki Activity

SEC-2280: Fix SessionFixationConfigurer#changeSessionId Javadoc 

The Javadoc for SessionFixationConfigurer#changeSessionId() was copied and pasted from
SessionFixationConfigurer#none() and never updated. It is incorrect. This commit fixes that.
This commit is contained in:
Nick Williams 2013-08-24 22:13:40 -05:00 committed by Rob Winch
parent 48283ec004
commit f29505d657
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
config/src/main/java/org/springframework/security/config/annotation/web/configurers/SessionManagementConfigurer.java
View File

@ -242,14 +242,17 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
}
/**
* Specifies that no session fixation protection should be enabled. This
* may be useful when utilizing other mechanisms for protecting against
* session fixation. For example, if application container session
* fixation protection is already in use. Otherwise, this option is not
* recommended.
* Specifies that the Servlet container-provided session fixation
* protection should be used. When a session authenticates, the
* Servlet 3.1 method {@code HttpServletRequest#changeSessionId()} is
* called to change the session ID and retain all session attributes.
* Using this option in a Servlet 3.0 or older container results in an
* {@link IllegalStateException}.
*
* @return the {@link SessionManagementConfigurer} for further
* customizations
* @throws IllegalStateException if the container is not Servlet 3.1 or
* newer.
*/
public SessionManagementConfigurer<H> changeSessionId() {
setSessionFixationAuthenticationStrategy(new ChangeSessionIdAuthenticationStrategy());
@ -451,4 +454,4 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
return new SessionFixationProtectionStrategy();
}
}
}
}