Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-04 01:07:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

AuthenticationFilter Session Fixation Protection

Browse Source 
Fixes gh-7446
This commit is contained in:
Josh Cummings
2019-09-17 08:15:52 -06:00
parent 496a2cdc60
commit 7576dc44d7
2 changed files with 37 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/src/main/java/org/springframework/security/web/authentication/AuthenticationFilter.java
+6 -1
View File
@@ -16,12 +16,12 @@
package org.springframework.security.web.authentication;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.springframework.http.HttpStatus;
import org.springframework.security.authentication.AuthenticationManager;
@@ -146,6 +146,11 @@ public class AuthenticationFilter extends OncePerRequestFilter {
return;
}
HttpSession session = request.getSession(false);
if (session != null) {
request.changeSessionId();
}
successfulAuthentication(request, response, filterChain, authenticationResult);
} catch (AuthenticationException e) {
unsuccessfulAuthentication(request, response, e);