root
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Actions 9 Packages Projects Releases Wiki Activity

SEC-2280: Fix SessionFixationConfigurer#changeSessionId Javadoc 

The Javadoc for SessionFixationConfigurer#changeSessionId() was copied and pasted from
SessionFixationConfigurer#none() and never updated. It is incorrect. This commit fixes that.
This commit is contained in:
Nick Williams 2013-08-24 22:13:40 -05:00 committed by Rob Winch
parent 48283ec004
commit f29505d657
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
config/src/main/java/org/springframework/security/config/annotation/web/configurers/SessionManagementConfigurer.java
View File

@ -242,14 +242,17 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
} }
/** /**
* Specifies that no session fixation protection should be enabled. This * Specifies that the Servlet container-provided session fixation
* may be useful when utilizing other mechanisms for protecting against * protection should be used. When a session authenticates, the
* session fixation. For example, if application container session * Servlet 3.1 method {@code HttpServletRequest#changeSessionId()} is
* fixation protection is already in use. Otherwise, this option is not * called to change the session ID and retain all session attributes.
* recommended. * Using this option in a Servlet 3.0 or older container results in an
* {@link IllegalStateException}.
* *
* @return the {@link SessionManagementConfigurer} for further * @return the {@link SessionManagementConfigurer} for further
* customizations * customizations
* @throws IllegalStateException if the container is not Servlet 3.1 or
* newer.
*/ */
public SessionManagementConfigurer<H> changeSessionId() { public SessionManagementConfigurer<H> changeSessionId() {
setSessionFixationAuthenticationStrategy(new ChangeSessionIdAuthenticationStrategy()); setSessionFixationAuthenticationStrategy(new ChangeSessionIdAuthenticationStrategy());
@ -451,4 +454,4 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
return new SessionFixationProtectionStrategy(); return new SessionFixationProtectionStrategy();
} }
} }
} }