SEC-539: Refactored if (httpSession == null) block in storeSecurityContextInSession()

core/src/main/java/org/acegisecurity/context/HttpSessionContextIntegrationFilter.java

@@ -331,21 +331,22 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean, Fi
                                                boolean httpSessionExistedAtStartOfRequest,
                                                int contextWhenChainProceeded) {
         HttpSession httpSession = null;
+
         try {
             httpSession = ((HttpServletRequest) request).getSession(false);
         }
         catch (IllegalStateException ignored) {
         }
 
-        if ((httpSession == null) && httpSessionExistedAtStartOfRequest) {
+        if (httpSession == null) {
+            if (httpSessionExistedAtStartOfRequest) {
                 if (logger.isDebugEnabled()) {
                     logger.debug("HttpSession is now null, but was not null at start of request; "
                             + "session was invalidated, so do not create a new session");
                 }
-        }
+            } else {
-
                 // Generate a HttpSession only if we need to
-        if ((httpSession == null) && !httpSessionExistedAtStartOfRequest) {
+
                 if (!allowSessionCreation) {
                     if (logger.isDebugEnabled()) {
                         logger
@@ -366,13 +367,13 @@ public class HttpSessionContextIntegrationFilter implements InitializingBean, Fi
                     }
                 } else {
                     if (logger.isDebugEnabled()) {
-                    logger
+                        logger.debug("HttpSession is null, but SecurityContextHolder has not changed from default: ' "
-                            .debug("HttpSession is null, but SecurityContextHolder has not changed from default: ' "
                                 + SecurityContextHolder.getContext()
                                 + "'; not creating HttpSession or storing SecurityContextHolder contents");
                     }
                 }
             }
+        }
 
         // If HttpSession exists, store current
         // SecurityContextHolder contents but only if