SEC-2002: Added events to notify of session ID change #33
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Session fixation protection, whether by clean new session or
migrated session, now publishes an event when a session is
migrated or its ID is changed. This enables application developers
to keep track of the session ID of a particular authentication
from the time the authentication is successful until the time
of logout. Previously this was not possible since session
migration changed the session ID and there was no way to
reliably detect that.
Revised changes per Rob Winch's suggestions. All of the events
have been consolidated into the one event, as requested. The
ApplicationEventPublisher
inSessionFixationProtectionStrategy
isinitialized to a
NullEventPublisher
now, as requested. The commitis much simpler and more concise than previous commits. Instead
of changing existing unit tests, I only added new unit tests to test
my new behavior. The existing unit tests remain to demonstrate that
old behavior (without
ApplicationEventPublisher
) hasn't beenaffected.
Apologies in advance that the imports for
SessionFixationProtectionStrategy
have been reorganized. Itwould seem that no two classes in SpringSecurity have their import
statements ordered/organized the same way. This makes it hard to
work in an IDE. I had to import new files, so my IDE was going to
reorder them. I set up my import settings so that my changes
would reorder the changes in only one file instead of all three that
I changed. That was the best I can get it. At least, the reorder
of imports improved the code. More consistency now.
Hopefully this pull request is much more satisfactory than
pull request #30, which can now be closed at your leisure.