spring/spring-framework
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-framework.git synced 2026-09-17 16:39:29 +00:00
Code Issues Projects Releases Wiki Activity

Fix mock servlet request behavior with session ids

Browse Source 
Prior to this commit,
`MockHttpServletRequest.isRequestedSessionIdValid()` would return `true`
by default and could only be changed manually with a setter. This does
not align with the Servlet spec because of 1) its default value and 2)
it does not react to `changeSessionId()` calls.

This commit fixes that behavior while still allowing "manual" booleans
being set here.

Fixes gh-36631
This commit is contained in:
Brian Clozel
2026-08-27 14:34:49 +02:00
parent 495fd6b3a5
commit 3170dd5714
3 changed files with 47 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spring-test/src/main/java/org/springframework/mock/web/MockHttpServletRequest.java
+10 -2
View File
@@ -251,7 +251,7 @@ public class MockHttpServletRequest implements HttpServletRequest {
private @Nullable HttpSession session;
private boolean requestedSessionIdValid = true;
private @Nullable Boolean requestedSessionIdValid;
private boolean requestedSessionIdFromCookie = true;
@@ -1352,7 +1352,15 @@ public class MockHttpServletRequest implements HttpServletRequest {
@Override
public boolean isRequestedSessionIdValid() {
return this.requestedSessionIdValid;
if (this.requestedSessionIdValid != null) {
return this.requestedSessionIdValid;
}
String requestedId = getRequestedSessionId();
if (requestedId == null) {
return false;
}
HttpSession currentSession = getSession(false);
return (currentSession != null && requestedId.equals(currentSession.getId()));
}
public void setRequestedSessionIdFromCookie(boolean requestedSessionIdFromCookie) {
spring-test/src/test/java/org/springframework/mock/web/MockHttpServletRequestTests.java
+27
View File
@@ -714,6 +714,33 @@ class MockHttpServletRequestTests {
assertThat(listenerEvent.event.getAsyncContext()).isEqualTo(newAsyncContext);
}
@Test
void requestedSessionIdValidShouldDefaultToFalse() {
assertThat(request.getRequestedSessionId()).isNull();
assertThat(request.isRequestedSessionIdValid()).isFalse();
}
@Test
void requestedSessionIdValidShouldReturnTrueWhenSessionValid() {
MockHttpSession session = new MockHttpSession();
request.setSession(session);
request.setRequestedSessionId(session.getId());
assertThat(request.getRequestedSessionId()).isEqualTo(session.getId());
assertThat(request.isRequestedSessionIdValid()).isTrue();
}
@Test
void requestedSessionIdValidShouldReturnFalseWhenRotated() {
MockHttpSession session = new MockHttpSession();
request.setSession(session);
request.setRequestedSessionId(session.getId());
String previousRequestedId = request.getRequestedSessionId();
request.changeSessionId();
assertThat(session.getId()).isNotEqualTo(previousRequestedId);
assertThat(request.getRequestedSessionId()).isEqualTo(previousRequestedId);
assertThat(request.isRequestedSessionIdValid()).isFalse();
}
private void assertEqualEnumerations(Enumeration<?> enum1, Enumeration<?> enum2) {
int count = 0;
while (enum1.hasMoreElements()) {
spring-web/src/testFixtures/java/org/springframework/web/testfixture/servlet/MockHttpServletRequest.java
+10 -2
View File
@@ -251,7 +251,7 @@ public class MockHttpServletRequest implements HttpServletRequest {
private @Nullable HttpSession session;
private boolean requestedSessionIdValid = true;
private @Nullable Boolean requestedSessionIdValid;
private boolean requestedSessionIdFromCookie = true;
@@ -1352,7 +1352,15 @@ public class MockHttpServletRequest implements HttpServletRequest {
@Override
public boolean isRequestedSessionIdValid() {
return this.requestedSessionIdValid;
if (this.requestedSessionIdValid != null) {
return this.requestedSessionIdValid;
}
String requestedId = getRequestedSessionId();
if (requestedId == null) {
return false;
}
HttpSession currentSession = getSession(false);
return (currentSession != null && requestedId.equals(currentSession.getId()));
}
public void setRequestedSessionIdFromCookie(boolean requestedSessionIdFromCookie) {