SessionRegistryImpl is now aware of SessionIdChangedEvent

web/src/main/java/org/springframework/security/web/session/HttpSessionEventPublisher.java

@@ -25,6 +25,7 @@ import org.springframework.security.web.context.support.SecurityWebApplicationCo
 
 import javax.servlet.ServletContext;
 import javax.servlet.http.HttpSessionEvent;
+import javax.servlet.http.HttpSessionIdListener;
 import javax.servlet.http.HttpSessionListener;
 
 /**
@@ -44,7 +45,7 @@ import javax.servlet.http.HttpSessionListener;
  *
  * @author Ray Krueger
  */
-public class HttpSessionEventPublisher implements HttpSessionListener {
+public class HttpSessionEventPublisher implements HttpSessionListener, HttpSessionIdListener {
 	// ~ Static fields/initializers
 	// =====================================================================================
 
@@ -90,4 +91,16 @@ public class HttpSessionEventPublisher implements HttpSessionListener {
 
 		getContext(event.getSession().getServletContext()).publishEvent(e);
 	}
+
+	@Override
+	public void sessionIdChanged(HttpSessionEvent event, String oldSessionId) {
+		HttpSessionIdChangedEvent e = new HttpSessionIdChangedEvent(event.getSession(), oldSessionId);
+		Log log = LogFactory.getLog(LOGGER_NAME);
+
+		if (log.isDebugEnabled()) {
+			log.debug("Publishing event: " + e);
+		}
+
+		getContext(event.getSession().getServletContext()).publishEvent(e);
+	}
 }

web/src/main/java/org/springframework/security/web/session/HttpSessionIdChangedEvent.java

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.web.session;
+
+import javax.servlet.http.HttpSession;
+
+import org.springframework.security.core.session.SessionIdChangedEvent;
+
+/**
+ * Published by the {@link HttpSessionEventPublisher} when an {@code HttpSession} id
+ * is changed
+ *
+ */
+public class HttpSessionIdChangedEvent extends SessionIdChangedEvent {
+	private final String oldSessionId;
+	private final String newSessionid;
+	// ~ Constructors
+	// ===================================================================================================
+
+	public HttpSessionIdChangedEvent(HttpSession session, String oldSessionId) {
+		super(session);
+		this.oldSessionId = oldSessionId;
+		this.newSessionid = session.getId();
+	}
+
+	public String getOldSessionId() {
+		return oldSessionId;
+	}
+
+	@Override
+	public String getNewSessionId() {
+		return newSessionid;
+	}
+}

web/src/test/java/org/springframework/security/web/session/HttpSessionEventPublisherTests.java

@@ -72,6 +72,11 @@ public class HttpSessionEventPublisherTests {
 		assertThat(listener.getDestroyedEvent()).isNotNull();
 		assertThat(listener.getCreatedEvent()).isNull();
 		assertThat(listener.getDestroyedEvent().getSession()).isEqualTo(session);
+
+		publisher.sessionIdChanged(event, "oldSessionId");
+		assertThat(listener.getSessionIdChangedEvent()).isNotNull();
+		assertThat(listener.getSessionIdChangedEvent().getOldSessionId()).isEqualTo("oldSessionId");
+		listener.setSessionIdChangedEvent(null);
 	}
 
 	@Test
@@ -108,6 +113,11 @@ public class HttpSessionEventPublisherTests {
 		assertThat(listener.getDestroyedEvent()).isNotNull();
 		assertThat(listener.getCreatedEvent()).isNull();
 		assertThat(listener.getDestroyedEvent().getSession()).isEqualTo(session);
+
+		publisher.sessionIdChanged(event, "oldSessionId");
+		assertThat(listener.getSessionIdChangedEvent()).isNotNull();
+		assertThat(listener.getSessionIdChangedEvent().getOldSessionId()).isEqualTo("oldSessionId");
+		listener.setSessionIdChangedEvent(null);
 	}
 
 	// SEC-2599
@@ -131,4 +141,14 @@ public class HttpSessionEventPublisherTests {
 
 		publisher.sessionDestroyed(event);
 	}
+
+	@Test(expected = IllegalStateException.class)
+	public void sessionIdChangeNullApplicationContext() {
+		HttpSessionEventPublisher publisher = new HttpSessionEventPublisher();
+		MockServletContext servletContext = new MockServletContext();
+		MockHttpSession session = new MockHttpSession(servletContext);
+		HttpSessionEvent event = new HttpSessionEvent(session);
+
+		publisher.sessionIdChanged(event, "oldSessionId");
+	}
 }

web/src/test/java/org/springframework/security/web/session/MockApplicationListener.java

@@ -32,6 +32,7 @@ public class MockApplicationListener implements ApplicationListener<ApplicationE
 
 	private HttpSessionCreatedEvent createdEvent;
 	private HttpSessionDestroyedEvent destroyedEvent;
+	private HttpSessionIdChangedEvent sessionIdChangedEvent;
 
 	// ~ Methods
 	// ========================================================================================================
@@ -51,6 +52,9 @@ public class MockApplicationListener implements ApplicationListener<ApplicationE
 		else if (event instanceof HttpSessionDestroyedEvent) {
 			destroyedEvent = (HttpSessionDestroyedEvent) event;
 		}
+		else if (event instanceof HttpSessionIdChangedEvent) {
+			sessionIdChangedEvent = (HttpSessionIdChangedEvent) event;
+		}
 	}
 
 	public void setCreatedEvent(HttpSessionCreatedEvent createdEvent) {
@@ -60,4 +64,12 @@ public class MockApplicationListener implements ApplicationListener<ApplicationE
 	public void setDestroyedEvent(HttpSessionDestroyedEvent destroyedEvent) {
 		this.destroyedEvent = destroyedEvent;
 	}
+
+	public void setSessionIdChangedEvent(HttpSessionIdChangedEvent sessionIdChangedEvent) {
+		this.sessionIdChangedEvent = sessionIdChangedEvent;
+	}
+
+	public HttpSessionIdChangedEvent getSessionIdChangedEvent() {
+		return sessionIdChangedEvent;
+	}
 }