spring/spring-boot
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-boot.git synced 2026-09-17 12:09:16 +00:00
Code Issues Projects Releases Wiki Activity

Only set Partitioned cookie attribute when true

Browse Source 
The session cookie's Partitioned attribute was set to "" for any
non-null value, so an explicit `partitioned=false` was rendered the
same as `true`. PropertyMapper.to() only filters null, so
Boolean.FALSE reached the consumer and the attribute was always set.

Use whenTrue() so the attribute is set only when partitioned is true,
leaving false and unset to fall through to the container default.

Closes gh-50781

Signed-off-by: Lee JiWon <dlwldnjs1009@gmail.com>
This commit is contained in:
Lee JiWon
2026-06-18 16:52:55 +02:00
committed by Brian Clozel
parent 262437f94c
commit 4b542efc0c
2 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
module/spring-boot-web-server/src/main/java/org/springframework/boot/web/server/servlet/ServletContextInitializers.java
+1 -1
View File
@@ -97,7 +97,7 @@ public final class ServletContextInitializers implements Iterable<ServletContext
map.from(cookie::getHttpOnly).to(config::setHttpOnly);
map.from(cookie::getSecure).to(config::setSecure);
map.from(cookie::getMaxAge).asInt(Duration::getSeconds).to(config::setMaxAge);
map.from(cookie::getPartitioned).to((partitioned) -> config.setAttribute("Partitioned", ""));
map.from(cookie::getPartitioned).whenTrue().to((partitioned) -> config.setAttribute("Partitioned", ""));
}
@Contract("!null -> !null")
module/spring-boot-web-server/src/testFixtures/java/org/springframework/boot/web/server/servlet/AbstractServletWebServerFactoryTests.java
+15 -1
View File
@@ -899,6 +899,20 @@ public abstract class AbstractServletWebServerFactoryTests {
(header) -> assertThat(header).isEqualTo("test=test"));
}
@Test
void sessionCookieNotPartitionedAttribute() throws Exception {
ConfigurableServletWebServerFactory factory = getFactory();
factory.getSettings().getSession().getCookie().setPartitioned(false);
factory.addInitializers(new ServletRegistrationBean<>(new CookieServlet(false), "/"));
this.webServer = factory.getWebServer();
this.webServer.start();
ClientHttpResponse clientResponse = getClientResponse(getLocalUrl("/"));
List<String> setCookieHeaders = clientResponse.getHeaders().get("Set-Cookie");
assertThat(setCookieHeaders).satisfiesExactlyInAnyOrder(
(header) -> assertThat(header).startsWith("JSESSIONID=").doesNotContain("; Partitioned"),
(header) -> assertThat(header).isEqualTo("test=test"));
}
@ParameterizedTest
@EnumSource(mode = EnumSource.Mode.EXCLUDE, names = "OMITTED")
void sessionCookieSameSiteAttributeCanBeConfiguredAndOnlyAffectsSessionCookies(SameSite sameSite) throws Exception {
@@ -1226,7 +1240,7 @@ public abstract class AbstractServletWebServerFactoryTests {
assertThat(sessionCookieConfig.isHttpOnly()).isTrue();
assertThat(sessionCookieConfig.isSecure()).isTrue();
assertThat(sessionCookieConfig.getMaxAge()).isEqualTo(60);
assertThat(sessionCookieConfig.getAttribute("Partitioned")).isEqualTo("");
assertThat(sessionCookieConfig.getAttribute("Partitioned")).isNull();
}
@Test