Package org.springframework.security.web.authentication.session

# Class AbstractSessionFixationProtectionStrategy

java.lang.Object
org.springframework.security.web.authentication.session.AbstractSessionFixationProtectionStrategy

All Implemented Interfaces:
  `org.springframework.beans.factory.Aware`, `org.springframework.context.ApplicationEventPublisherAware`, `SessionAuthenticationStrategy`

Direct Known Subclasses:
  `ChangeSessionIdAuthenticationStrategy`, `SessionFixationProtectionStrategy`

public abstract class AbstractSessionFixationProtectionStrategy extends Object implements SessionAuthenticationStrategy, org.springframework.context.ApplicationEventPublisherAware
A base class for performing session fixation protection.

Since:
  3.2

## Nested Class Summary

Nested Classes
Modifier and Type
Class
Description
`protected static final class`
`AbstractSessionFixationProtectionStrategy.NullEventPublisher`

## Field Summary

Fields
Modifier and Type
Field
Description
`protected final org.apache.commons.logging.Log`
`logger`

## Method Summary

Modifier and Type
Method
Description
`void`
`onAuthentication(org.springframework.security.core.Authentication authentication, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)`
Called when a user is newly authenticated.
`protected void`
`onSessionChange(String originalSessionId, jakarta.servlet.http.HttpSession newSession, org.springframework.security.core.Authentication auth)`
Called when the session has been changed and the old attributes have been migrated to the new session.
`void`
`setAlwaysCreateSession(boolean alwaysCreateSession)`
`void`
`setApplicationEventPublisher(org.springframework.context.ApplicationEventPublisher applicationEventPublisher)`
Sets the `ApplicationEventPublisher` to use for submitting `SessionFixationProtectionEvent`.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### logger

protected final org.apache.commons.logging.Log logger

## Method Details

### onAuthentication

public void onAuthentication(org.springframework.security.core.Authentication authentication, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
Called when a user is newly authenticated.

If a session already exists, and matches the session Id from the client, a new session will be created, and the session attributes copied to it (if `migrateSessionAttributes` is set). If the client's requested session Id is invalid, nothing will be done, since there is no need to change the session Id if it doesn't match the current session.

If there is no session, no action is taken unless the `alwaysCreateSession` property is set, in which case a session will be created if one doesn't already exist.

Specified by:
  `onAuthentication` in interface `SessionAuthenticationStrategy`

### onSessionChange

protected void onSessionChange(String originalSessionId, jakarta.servlet.http.HttpSession newSession, org.springframework.security.core.Authentication auth)
Called when the session has been changed and the old attributes have been migrated to the new session. Only called if a session existed to start with. Allows subclasses to plug in additional behaviour. *

The default implementation of this method publishes a `SessionFixationProtectionEvent` to notify the application that the session ID has changed. If you override this method and still wish these events to be published, you should call `super.onSessionChange()` within your overriding method.

Parameters:
  `originalSessionId` - the original session identifier
  `newSession` - the newly created session
  `auth` - the token for the newly authenticated principal

### setApplicationEventPublisher

public void setApplicationEventPublisher(org.springframework.context.ApplicationEventPublisher applicationEventPublisher)
Sets the `ApplicationEventPublisher` to use for submitting `SessionFixationProtectionEvent`. The default is to not submit the `SessionFixationProtectionEvent`.

Specified by:
  `setApplicationEventPublisher` in interface `org.springframework.context.ApplicationEventPublisherAware`
Parameters:
  `applicationEventPublisher` - the `ApplicationEventPublisher`. Cannot be null.

### setAlwaysCreateSession

public void setAlwaysCreateSession(boolean alwaysCreateSession)