Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-22 12:02:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-1561: Add check on whether the security context attribute is set in the current session to make sure it is stored when a new session has been created during the request.

Browse Source
This commit is contained in:
Luke Taylor 2010-11-10 12:53:56 +00:00
parent 979ea63980
commit e88f47a96a
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java
View File

@ -344,7 +344,9 @@ public class HttpSessionSecurityContextRepository implements SecurityContextRepo
// If HttpSession exists, store current SecurityContextHolder contents but only if
// the SecurityContext has actually changed (see JIRA SEC-37)
if (httpSession != null && context.hashCode() != contextHashBeforeChainExecution) {
// We also check that the session contains the context, in case a new session has been created (SEC-1561)
if (httpSession != null && (context.hashCode() != contextHashBeforeChainExecution ||
httpSession.getAttribute(SPRING_SECURITY_CONTEXT_KEY) == null)) {
httpSession.setAttribute(SPRING_SECURITY_CONTEXT_KEY, context);
if (logger.isDebugEnabled()) {