From 4b542efc0c3c6a5b753a7ec198b7162d2879b99e Mon Sep 17 00:00:00 2001 From: Lee JiWon Date: Wed, 17 Jun 2026 09:19:53 +0900 Subject: [PATCH] Only set Partitioned cookie attribute when true The session cookie's Partitioned attribute was set to "" for any non-null value, so an explicit `partitioned=false` was rendered the same as `true`. PropertyMapper.to() only filters null, so Boolean.FALSE reached the consumer and the attribute was always set. Use whenTrue() so the attribute is set only when partitioned is true, leaving false and unset to fall through to the container default. Closes gh-50781 Signed-off-by: Lee JiWon --- .../servlet/ServletContextInitializers.java | 2 +- .../AbstractServletWebServerFactoryTests.java | 16 +++++++++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/module/spring-boot-web-server/src/main/java/org/springframework/boot/web/server/servlet/ServletContextInitializers.java b/module/spring-boot-web-server/src/main/java/org/springframework/boot/web/server/servlet/ServletContextInitializers.java index 721ff5ccb10..5506ae15d71 100644 --- a/module/spring-boot-web-server/src/main/java/org/springframework/boot/web/server/servlet/ServletContextInitializers.java +++ b/module/spring-boot-web-server/src/main/java/org/springframework/boot/web/server/servlet/ServletContextInitializers.java @@ -97,7 +97,7 @@ public final class ServletContextInitializers implements Iterable config.setAttribute("Partitioned", "")); + map.from(cookie::getPartitioned).whenTrue().to((partitioned) -> config.setAttribute("Partitioned", "")); } @Contract("!null -> !null") diff --git a/module/spring-boot-web-server/src/testFixtures/java/org/springframework/boot/web/server/servlet/AbstractServletWebServerFactoryTests.java b/module/spring-boot-web-server/src/testFixtures/java/org/springframework/boot/web/server/servlet/AbstractServletWebServerFactoryTests.java index 0074c492d68..c841c7de887 100644 --- a/module/spring-boot-web-server/src/testFixtures/java/org/springframework/boot/web/server/servlet/AbstractServletWebServerFactoryTests.java +++ b/module/spring-boot-web-server/src/testFixtures/java/org/springframework/boot/web/server/servlet/AbstractServletWebServerFactoryTests.java @@ -899,6 +899,20 @@ public abstract class AbstractServletWebServerFactoryTests { (header) -> assertThat(header).isEqualTo("test=test")); } + @Test + void sessionCookieNotPartitionedAttribute() throws Exception { + ConfigurableServletWebServerFactory factory = getFactory(); + factory.getSettings().getSession().getCookie().setPartitioned(false); + factory.addInitializers(new ServletRegistrationBean<>(new CookieServlet(false), "/")); + this.webServer = factory.getWebServer(); + this.webServer.start(); + ClientHttpResponse clientResponse = getClientResponse(getLocalUrl("/")); + List setCookieHeaders = clientResponse.getHeaders().get("Set-Cookie"); + assertThat(setCookieHeaders).satisfiesExactlyInAnyOrder( + (header) -> assertThat(header).startsWith("JSESSIONID=").doesNotContain("; Partitioned"), + (header) -> assertThat(header).isEqualTo("test=test")); + } + @ParameterizedTest @EnumSource(mode = EnumSource.Mode.EXCLUDE, names = "OMITTED") void sessionCookieSameSiteAttributeCanBeConfiguredAndOnlyAffectsSessionCookies(SameSite sameSite) throws Exception { @@ -1226,7 +1240,7 @@ public abstract class AbstractServletWebServerFactoryTests { assertThat(sessionCookieConfig.isHttpOnly()).isTrue(); assertThat(sessionCookieConfig.isSecure()).isTrue(); assertThat(sessionCookieConfig.getMaxAge()).isEqualTo(60); - assertThat(sessionCookieConfig.getAttribute("Partitioned")).isEqualTo(""); + assertThat(sessionCookieConfig.getAttribute("Partitioned")).isNull(); } @Test