Remove Servlet 2.5 Support for Session Fixation #6259
Labels
Milestone
Comments
jzheaux
added
in: web
7 tasks
|
|
|
Thanks the issue is yours @raphaelDL! |
raphaelDL
added a commit
to raphaelDL/spring-security
that referenced
this issue
Dec 20, 2018
This commit removes existence validation of a method only available in Servlet 3.1. Spring Framework baseline is Servlet 3.1 so is not longer required. Fixes: spring-projectsgh-6259
jzheaux
added a commit
that referenced
this issue
Dec 21, 2018
When using AssertJ, it's easy to commit the following error assertThat(some boolean condition) The above actually does nothing. It at least needs to be assertThat(some boolean condition).isTrue() This commit refines some assertions that were missing a verify condition. Also, one Javadoc was just a little bit confusing, so this clarifies it. Issue: gh-6259
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Related to #6220
There are a couple of different strategies available to users for performing session fixation. One such,
ChangeSessionIdSessionAuthenticationStrategy, requires a method only available onHttpServletRequestsince Servlet 3.1.Because of this, its constructor checks for the existence of that method and throws an exception otherwise.
Now that the Spring Framework baseline is Servlet 3.1, that check is no longer necessary.
Also, the corresponding
try/catchinSessionManagementConfigurerand the corresponding conditional inHttpConfigurationBuilderare no longer necessary.Of course, this also means that tests that confirm this behavior can also be removed.
The text was updated successfully, but these errors were encountered: