Remove Servlet 2.5 Support for Session Fixation

This commit removes existence validation of a method only available in Servlet 3.1.
Spring Framework baseline is Servlet 3.1 so is not longer required.

Fixes: gh-6259

web/src/main/java/org/springframework/security/web/authentication/session/ChangeSessionIdAuthenticationStrategy.java

@@ -15,33 +15,18 @@
  */
 package org.springframework.security.web.authentication.session;
 
-import java.lang.reflect.Method;
-
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpSession;
 
-import org.springframework.util.ReflectionUtils;
-
 /**
  * Uses {@code HttpServletRequest.changeSessionId()} to protect against session fixation
- * attacks. This is the default implementation for Servlet 3.1+.
+ * attacks. This is the default implementation.
  *
  * @author Rob Winch
  * @since 3.2
  */
 public final class ChangeSessionIdAuthenticationStrategy
 		extends AbstractSessionFixationProtectionStrategy {
-	private final Method changeSessionIdMethod;
-
-	public ChangeSessionIdAuthenticationStrategy() {
-		Method changeSessionIdMethod = ReflectionUtils
-				.findMethod(HttpServletRequest.class, "changeSessionId");
-		if (changeSessionIdMethod == null) {
-			throw new IllegalStateException(
-					"HttpServletRequest.changeSessionId is undefined. Are you using a Servlet 3.1+ environment?");
-		}
-		this.changeSessionIdMethod = changeSessionIdMethod;
-	}
 
 	/*
 	 * (non-Javadoc)
@@ -52,7 +37,7 @@ public final class ChangeSessionIdAuthenticationStrategy
 	 */
 	@Override
 	HttpSession applySessionFixation(HttpServletRequest request) {
-		ReflectionUtils.invokeMethod(this.changeSessionIdMethod, request);
+		request.changeSessionId();
 		return request.getSession();
 	}
 }

web/src/main/java/org/springframework/security/web/authentication/session/SessionFixationProtectionStrategy.java

@@ -24,7 +24,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpSession;
 
 /**
- * The default implementation of {@link SessionAuthenticationStrategy} when using <
+ * The implementation of {@link SessionAuthenticationStrategy} when using <
  * Servlet 3.1.
  * <p>
  * Creates a new session for the newly authenticated user if they already have a session

web/src/test/java/org/springframework/security/web/authentication/session/ChangeSessionIdAuthenticationStrategyTests.java

@@ -15,55 +15,26 @@
  */
 package org.springframework.security.web.authentication.session;
 
-import static org.mockito.Matchers.*;
-import static org.powermock.api.mockito.PowerMockito.*;
-
-import java.lang.reflect.Method;
-
-import javax.servlet.http.HttpServletRequest;
-
+import org.junit.Assert;
 import org.junit.Test;
 import org.junit.runner.RunWith;
-import org.mockito.Mock;
-import org.powermock.core.classloader.annotations.PrepareForTest;
 import org.powermock.modules.junit4.PowerMockRunner;
 import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.util.ReflectionUtils;
 
 /**
  * @author Rob Winch
  *
  */
 @RunWith(PowerMockRunner.class)
-@PrepareForTest({ ReflectionUtils.class, Method.class })
 public class ChangeSessionIdAuthenticationStrategyTests {
-	@Mock
-	private Method method;
-
-	@Test(expected = IllegalStateException.class)
-	public void constructChangeIdMethodNotFound() {
-		spy(ReflectionUtils.class);
-		MockHttpServletRequest request = new MockHttpServletRequest();
-		request.getSession();
-		when(ReflectionUtils.findMethod(HttpServletRequest.class, "changeSessionId"))
-				.thenReturn(null);
-
-		new ChangeSessionIdAuthenticationStrategy();
-	}
 
 	@Test
-	public void applySessionFixation() throws Exception {
-		spy(ReflectionUtils.class);
-		Method method = mock(Method.class);
+	public void applySessionFixation() {
 		MockHttpServletRequest request = new MockHttpServletRequest();
-		request.getSession();
-		when(ReflectionUtils.findMethod(HttpServletRequest.class, "changeSessionId"))
-				.thenReturn(method);
+		String id = request.getSession().getId();
 
-		new ChangeSessionIdAuthenticationStrategy().applySessionFixation(request);
+			new ChangeSessionIdAuthenticationStrategy().applySessionFixation(request);
 
-		verifyStatic(ReflectionUtils.class);
-		ReflectionUtils.invokeMethod(same(method), eq(request));
+		Assert.assertNotEquals(id, request.getSession().getId());
 	}
-
 }