From e37d0b0bb11677b6f4cfeb7654416a3545dde623 Mon Sep 17 00:00:00 2001
From: Luke Taylor <luke.taylor@springsource.com>
Date: Tue, 29 Jan 2008 16:28:17 +0000
Subject: [PATCH] SEC-543: sessionsUsedByPrincipal only needs to be added to
 "principals" map when it is first created.

---
 .../security/concurrent/SessionRegistryImpl.java           | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/core/src/main/java/org/springframework/security/concurrent/SessionRegistryImpl.java b/core/src/main/java/org/springframework/security/concurrent/SessionRegistryImpl.java
index 419ee1b6bb..57fec416ab 100644
--- a/core/src/main/java/org/springframework/security/concurrent/SessionRegistryImpl.java
+++ b/core/src/main/java/org/springframework/security/concurrent/SessionRegistryImpl.java
@@ -132,12 +132,11 @@ public class SessionRegistryImpl implements SessionRegistry, ApplicationListener
         Set sessionsUsedByPrincipal = (Set) principals.get(principal);
 
 		if (sessionsUsedByPrincipal == null) {
-			sessionsUsedByPrincipal = Collections.synchronizedSet(new HashSet());
-		}
+			sessionsUsedByPrincipal = Collections.synchronizedSet(new HashSet(4));
+            principals.put(principal, sessionsUsedByPrincipal);
+        }
 
 		sessionsUsedByPrincipal.add(sessionId);
-
-		principals.put(principal, sessionsUsedByPrincipal);
 	}
 
 	public void removeSessionInformation(String sessionId) {