Phillip Webb 1a764d9c06 Default Tomcat to not save SESSIONS.ser file ...

Update TomcatEmbeddedServletContainerFactory so that session data isn't
serialized by default. Prior to this commit the SESSIONS.ser file would
either be written to `/tmp` or into `baseDir` (if one was set).

By not saving session data we align Tomcat with the other embedded
servlet containers and reduce the risk of sensitive information being
left in `/tmp`.

Fixes gh-4156

2015-10-14 21:30:19 -07:00

..

src

Default Tomcat to not save SESSIONS.ser file

2015-10-14 21:30:19 -07:00

pom.xml

Next development version

2015-09-16 09:00:17 -07:00