Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-05-30 16:52:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-2011: Remove reference to SessionRegistry from SessionFixationProtectionStrategy javadoc

Browse Source 
Previously SessionFixationProtectionStrategy javadoc mentioned injecting
the SessionRegistry. However, this property is only available on
ConcurrentSessionControlStrategy (a subclass).

Now the mention has been removed. It is apparent the property is required
in ConcurrentSessionControlStrategy since it uses constructor injection.
This commit is contained in:
Rob Winch 2012-07-19 10:20:40 -05:00
parent 095dcb3a74
commit b868daaa8c
1 changed files with 0 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
web/src/main/java/org/springframework/security/web/authentication/session/SessionFixationProtectionStrategy.java
View File

@ -21,8 +21,6 @@ import java.util.*;
* This approach will only be effective if your servlet container always assigns a new session Id when a session is
* invalidated and a new session created by calling {@link HttpServletRequest#getSession()}.
* <p>
* If concurrent session control is in use, then a {@code SessionRegistry} must be injected.
* <p>
* <h3>Issues with {@code HttpSessionBindingListener}</h3>
* <p>
* The migration of existing attributes to the newly-created session may cause problems if any of the objects