Package org.springframework.security.web.authentication.session

# Class SessionFixationProtectionStrategy

java.lang.Object
org.springframework.security.web.authentication.session.AbstractSessionFixationProtectionStrategy
org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy

All Implemented Interfaces:
  `org.springframework.beans.factory.Aware`, `org.springframework.context.ApplicationEventPublisherAware`, `SessionAuthenticationStrategy`

public class SessionFixationProtectionStrategy extends AbstractSessionFixationProtectionStrategy
Uses `HttpServletRequest.invalidate()` to protect against session fixation attacks.

Creates a new session for the newly authenticated user if they already have a session (as a defence against session-fixation protection attacks), and copies their session attributes across to the new session. The copying of the attributes can be disabled by setting `migrateSessionAttributes` to `false` (note that even in this case, internal Spring Security attributes will still be migrated to the new session).

This approach will only be effective if your servlet container always assigns a new session Id when a session is invalidated and a new session created by calling `HttpServletRequest.getSession()`.

### Issues with `HttpSessionBindingListener`

The migration of existing attributes to the newly-created session may cause problems if any of the objects implement the `HttpSessionBindingListener` interface in a way which makes assumptions about the life-cycle of the object. An example is the use of Spring session-scoped beans, where the initial removal of the bean from the session will cause the `DisposableBean` interface to be invoked, in the assumption that the bean is no longer required.

We'd recommend that you take account of this when designing your application and do not store attributes which may not function correctly when they are removed and then placed back in the session. Alternatively, you should customize the `SessionAuthenticationStrategy` to deal with the issue in an application-specific way.

Since:
  3.0

## Nested Class Summary

## Nested classes/interfaces inherited from class org.springframework.security.web.authentication.session.AbstractSessionFixationProtectionStrategy

`AbstractSessionFixationProtectionStrategy.NullEventPublisher`

## Field Summary

### Fields inherited from class org.springframework.security.web.authentication.session.AbstractSessionFixationProtectionStrategy

`logger`

## Constructor Summary

Constructors
Constructor
Description
`SessionFixationProtectionStrategy()`

## Method Summary

Modifier and Type
Method
Description
`protected Map<String,Object>`
`extractAttributes(jakarta.servlet.http.HttpSession session)`
Called to extract the existing attributes from the session, prior to invalidating it.
`void`
`setMigrateSessionAttributes(boolean migrateSessionAttributes)`
Defines whether attributes should be migrated to a new session or not.

### Methods inherited from class org.springframework.security.web.authentication.session.AbstractSessionFixationProtectionStrategy

`onAuthentication, onSessionChange, setAlwaysCreateSession, setApplicationEventPublisher`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Constructor Details

### SessionFixationProtectionStrategy

public SessionFixationProtectionStrategy()

## Method Details

### extractAttributes

protected Map<String,Object> extractAttributes(jakarta.servlet.http.HttpSession session)
Called to extract the existing attributes from the session, prior to invalidating it. If `migrateAttributes` is set to `false`, only Spring Security attributes will be retained. All application attributes will be discarded.

You can override this method to control exactly what is transferred to the new session.

Parameters:
  `session` - the session from which the attributes should be extracted
Returns:
  the map of session attributes which should be transferred to the new session

### setMigrateSessionAttributes

public void setMigrateSessionAttributes(boolean migrateSessionAttributes)
Defines whether attributes should be migrated to a new session or not. Has no effect if you override the `extractAttributes` method.

Attributes used by Spring Security (to store cached requests, for example) will still be retained by default, even if you set this value to `false`.

Parameters:
  `migrateSessionAttributes` - whether the attributes from the session should be transferred to the new, authenticated session.