From 0e6d47b08221983f0eb8840d42a1ac438bf8ad67 Mon Sep 17 00:00:00 2001
From: Craig Andrews <candrews@integralblue.com>
Date: Fri, 16 Apr 2021 12:18:44 -0400
Subject: [PATCH] Add guard around debug logging involving string concatenation

---
 .../session/RequestedUrlRedirectInvalidSessionStrategy.java   | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/web/src/main/java/org/springframework/security/web/session/RequestedUrlRedirectInvalidSessionStrategy.java b/web/src/main/java/org/springframework/security/web/session/RequestedUrlRedirectInvalidSessionStrategy.java
index 65c6f45c56..9d023701ff 100644
--- a/web/src/main/java/org/springframework/security/web/session/RequestedUrlRedirectInvalidSessionStrategy.java
+++ b/web/src/main/java/org/springframework/security/web/session/RequestedUrlRedirectInvalidSessionStrategy.java
@@ -46,7 +46,9 @@ public final class RequestedUrlRedirectInvalidSessionStrategy implements Invalid
 	public void onInvalidSessionDetected(HttpServletRequest request, HttpServletResponse response) throws IOException {
 		String destinationUrl = ServletUriComponentsBuilder.fromRequest(request).host(null).scheme(null).port(null)
 				.toUriString();
-		this.logger.debug("Starting new session (if required) and redirecting to '" + destinationUrl + "'");
+		if (this.logger.isDebugEnabled()) {
+			this.logger.debug("Starting new session (if required) and redirecting to '" + destinationUrl + "'");
+		}
 		if (this.createNewSession) {
 			request.getSession();
 		}