SEC-1499: Added some Javadoc and doc on the problems of using session-fixation protection with attributes that implement HttpSessionBindingListener.

2026-08-04 17:27:13 +00:00 · 2010-07-23 16:27:57 +01:00
parent d7d8448120
commit 9dd6a5eb8f
2 changed files with 18 additions and 2 deletions
@@ -57,8 +57,12 @@
    <beans:property name="sessionRegistry" ref="sessionRegistry" />
    <beans:property name="maximumSessions" value="1" />
 </beans:bean>
-]]>
-      </programlisting></para>
+]]></programlisting>
+            Note that the use of the default, <classname>SessionFixationProtectionStrategy</classname>
+            may cause issues if you are storing beans in the session which implement
+            <interfacename>HttpSessionBindingListener</interfacename>, including Spring session-scoped
+            beans. See the Javadoc for this class for more information.
+        </para>
    </section>
    <section xml:id="concurrent-sessions">
        <title>Concurrency Control</title>