Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-28 14:52:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-1211: Set the default AuthenticatedSessionStrategy to a null implementation to preserve existing behaviour.

Browse Source
This commit is contained in:
Luke Taylor 2009-07-28 23:57:46 +00:00
parent 609a68b12a
commit 5e285b3692
2 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.java
View File

@ -38,7 +38,7 @@ import org.springframework.security.core.SpringSecurityMessageSource;
import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.SpringSecurityFilter; import org.springframework.security.web.SpringSecurityFilter;
import org.springframework.security.web.session.AuthenticatedSessionStrategy; import org.springframework.security.web.session.AuthenticatedSessionStrategy;
import org.springframework.security.web.session.DefaultAuthenticatedSessionStrategy; import org.springframework.security.web.session.NullAuthenticatedSessionStrategy;
import org.springframework.security.web.util.UrlUtils; import org.springframework.security.web.util.UrlUtils;
import org.springframework.util.Assert; import org.springframework.util.Assert;
@ -129,7 +129,7 @@ public abstract class AbstractAuthenticationProcessingFilter extends SpringSecur
private boolean continueChainBeforeSuccessfulAuthentication = false; private boolean continueChainBeforeSuccessfulAuthentication = false;
private AuthenticatedSessionStrategy sessionStrategy = new DefaultAuthenticatedSessionStrategy(); private AuthenticatedSessionStrategy sessionStrategy = new NullAuthenticatedSessionStrategy();
private boolean allowSessionCreation = true; private boolean allowSessionCreation = true;
@ -393,7 +393,7 @@ public abstract class AbstractAuthenticationProcessingFilter extends SpringSecur
* successfully processed. Used, for example, to handle changing of the session identifier to prevent session * successfully processed. Used, for example, to handle changing of the session identifier to prevent session
* fixation attacks. * fixation attacks.
* *
* @param sessionStrategy the implementation to use. If not set a {@link DefaultAuthenticatedSessionStrategy} is * @param sessionStrategy the implementation to use. If not set a null implementation is
* used. * used.
*/ */
public void setAuthenticatedSessionStrategy(AuthenticatedSessionStrategy sessionStrategy) { public void setAuthenticatedSessionStrategy(AuthenticatedSessionStrategy sessionStrategy) {

19
web/src/main/java/org/springframework/security/web/session/NullAuthenticatedSessionStrategy.java Normal file
View File

@ -0,0 +1,19 @@
package org.springframework.security.web.session;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.core.Authentication;
/**
*
* @author Luke Taylor
* @version $Id$
* @since 3.0
*/
public final class NullAuthenticatedSessionStrategy implements AuthenticatedSessionStrategy {
public void onAuthenticationSuccess(Authentication authentication, HttpServletRequest request,
HttpServletResponse response) {
}
}