From b02f7ddea361d7f026dc241a6cc6408e275b3e05 Mon Sep 17 00:00:00 2001
From: Andy Wilkinson <andy.wilkinson@broadcom.com>
Date: Fri, 24 Apr 2026 14:58:31 +0100
Subject: [PATCH] Fix Partitioned session cooke attribute configuration with
 Tomcat

Fixes gh-50201
---
 .../servlet/ServletContextInitializers.java    |  4 +---
 .../AbstractServletWebServerFactoryTests.java  | 18 ++++++++++++++++--
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/module/spring-boot-web-server/src/main/java/org/springframework/boot/web/server/servlet/ServletContextInitializers.java b/module/spring-boot-web-server/src/main/java/org/springframework/boot/web/server/servlet/ServletContextInitializers.java
index 7a0080906fd..721ff5ccb10 100644
--- a/module/spring-boot-web-server/src/main/java/org/springframework/boot/web/server/servlet/ServletContextInitializers.java
+++ b/module/spring-boot-web-server/src/main/java/org/springframework/boot/web/server/servlet/ServletContextInitializers.java
@@ -97,9 +97,7 @@ public final class ServletContextInitializers implements Iterable<ServletContext
 			map.from(cookie::getHttpOnly).to(config::setHttpOnly);
 			map.from(cookie::getSecure).to(config::setSecure);
 			map.from(cookie::getMaxAge).asInt(Duration::getSeconds).to(config::setMaxAge);
-			map.from(cookie::getPartitioned)
-				.as(Object::toString)
-				.to((partitioned) -> config.setAttribute("Partitioned", partitioned));
+			map.from(cookie::getPartitioned).to((partitioned) -> config.setAttribute("Partitioned", ""));
 		}
 
 		@Contract("!null -> !null")
diff --git a/module/spring-boot-web-server/src/testFixtures/java/org/springframework/boot/web/server/servlet/AbstractServletWebServerFactoryTests.java b/module/spring-boot-web-server/src/testFixtures/java/org/springframework/boot/web/server/servlet/AbstractServletWebServerFactoryTests.java
index 2b6f4617734..0074c492d68 100644
--- a/module/spring-boot-web-server/src/testFixtures/java/org/springframework/boot/web/server/servlet/AbstractServletWebServerFactoryTests.java
+++ b/module/spring-boot-web-server/src/testFixtures/java/org/springframework/boot/web/server/servlet/AbstractServletWebServerFactoryTests.java
@@ -881,10 +881,24 @@ public abstract class AbstractServletWebServerFactoryTests {
 		assertThat(sessionCookieConfig.getPath()).isEqualTo("/testpath");
 		assertThat(sessionCookieConfig.isHttpOnly()).isTrue();
 		assertThat(sessionCookieConfig.isSecure()).isTrue();
-		assertThat(sessionCookieConfig.getAttribute("Partitioned")).isEqualTo("true");
+		assertThat(sessionCookieConfig.getAttribute("Partitioned")).isEqualTo("");
 		assertThat(sessionCookieConfig.getMaxAge()).isEqualTo(60);
 	}
 
+	@Test
+	void sessionCookiePartitionedAttribute() throws Exception {
+		ConfigurableServletWebServerFactory factory = getFactory();
+		factory.getSettings().getSession().getCookie().setPartitioned(true);
+		factory.addInitializers(new ServletRegistrationBean<>(new CookieServlet(false), "/"));
+		this.webServer = factory.getWebServer();
+		this.webServer.start();
+		ClientHttpResponse clientResponse = getClientResponse(getLocalUrl("/"));
+		List<String> setCookieHeaders = clientResponse.getHeaders().get("Set-Cookie");
+		assertThat(setCookieHeaders).satisfiesExactlyInAnyOrder(
+				(header) -> assertThat(header).startsWith("JSESSIONID=").contains("; Partitioned"),
+				(header) -> assertThat(header).isEqualTo("test=test"));
+	}
+
 	@ParameterizedTest
 	@EnumSource(mode = EnumSource.Mode.EXCLUDE, names = "OMITTED")
 	void sessionCookieSameSiteAttributeCanBeConfiguredAndOnlyAffectsSessionCookies(SameSite sameSite) throws Exception {
@@ -1212,7 +1226,7 @@ public abstract class AbstractServletWebServerFactoryTests {
 		assertThat(sessionCookieConfig.isHttpOnly()).isTrue();
 		assertThat(sessionCookieConfig.isSecure()).isTrue();
 		assertThat(sessionCookieConfig.getMaxAge()).isEqualTo(60);
-		assertThat(sessionCookieConfig.getAttribute("Partitioned")).isEqualTo("false");
+		assertThat(sessionCookieConfig.getAttribute("Partitioned")).isEqualTo("");
 	}
 
 	@Test