From 3b9a8dc53e5680755a07b582d37f25a1c169564a Mon Sep 17 00:00:00 2001 From: Ben Alex Date: Fri, 25 May 2007 01:38:42 +0000 Subject: [PATCH] SEC-444: Handle synchronization issues if multiple authentications taking place for same session ID concurrently. --- .../concurrent/ConcurrentSessionControllerImpl.java | 1 - .../org/acegisecurity/concurrent/SessionRegistryImpl.java | 6 ++---- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/core/src/main/java/org/acegisecurity/concurrent/ConcurrentSessionControllerImpl.java b/core/src/main/java/org/acegisecurity/concurrent/ConcurrentSessionControllerImpl.java index 22cf7383ab..8db34e916d 100644 --- a/core/src/main/java/org/acegisecurity/concurrent/ConcurrentSessionControllerImpl.java +++ b/core/src/main/java/org/acegisecurity/concurrent/ConcurrentSessionControllerImpl.java @@ -140,7 +140,6 @@ public class ConcurrentSessionControllerImpl implements ConcurrentSessionControl Object principal = SessionRegistryUtils.obtainPrincipalFromAuthentication(authentication); String sessionId = SessionRegistryUtils.obtainSessionIdFromAuthentication(authentication); - sessionRegistry.removeSessionInformation(sessionId); sessionRegistry.registerNewSession(sessionId, principal); } diff --git a/core/src/main/java/org/acegisecurity/concurrent/SessionRegistryImpl.java b/core/src/main/java/org/acegisecurity/concurrent/SessionRegistryImpl.java index 0e83b299da..6e2a69f0bf 100644 --- a/core/src/main/java/org/acegisecurity/concurrent/SessionRegistryImpl.java +++ b/core/src/main/java/org/acegisecurity/concurrent/SessionRegistryImpl.java @@ -112,14 +112,12 @@ public class SessionRegistryImpl implements SessionRegistry, } } - public void registerNewSession(String sessionId, Object principal) - throws SessionAlreadyUsedException { + public synchronized void registerNewSession(String sessionId, Object principal) { Assert.hasText(sessionId, "SessionId required as per interface contract"); Assert.notNull(principal, "Principal required as per interface contract"); if (getSessionInformation(sessionId) != null) { - throw new SessionAlreadyUsedException("Session " + sessionId - + " is already is use"); + removeSessionInformation(sessionId); } sessionIds.put(sessionId,