From 3170dd5714cb322895dcaef53830567dfe1ab410 Mon Sep 17 00:00:00 2001
From: Brian Clozel <brian.clozel@broadcom.com>
Date: Thu, 27 Aug 2026 14:34:49 +0200
Subject: [PATCH] Fix mock servlet request behavior with session ids

Prior to this commit,
`MockHttpServletRequest.isRequestedSessionIdValid()` would return `true`
by default and could only be changed manually with a setter. This does
not align with the Servlet spec because of 1) its default value and 2)
it does not react to `changeSessionId()` calls.

This commit fixes that behavior while still allowing "manual" booleans
being set here.

Fixes gh-36631
---
 .../mock/web/MockHttpServletRequest.java      | 12 +++++++--
 .../mock/web/MockHttpServletRequestTests.java | 27 +++++++++++++++++++
 .../servlet/MockHttpServletRequest.java       | 12 +++++++--
 3 files changed, 47 insertions(+), 4 deletions(-)

diff --git a/spring-test/src/main/java/org/springframework/mock/web/MockHttpServletRequest.java b/spring-test/src/main/java/org/springframework/mock/web/MockHttpServletRequest.java
index 5f5f58d9291..3c43cd2128f 100644
--- a/spring-test/src/main/java/org/springframework/mock/web/MockHttpServletRequest.java
+++ b/spring-test/src/main/java/org/springframework/mock/web/MockHttpServletRequest.java
@@ -251,7 +251,7 @@ public class MockHttpServletRequest implements HttpServletRequest {
 
 	private @Nullable HttpSession session;
 
-	private boolean requestedSessionIdValid = true;
+	private @Nullable Boolean requestedSessionIdValid;
 
 	private boolean requestedSessionIdFromCookie = true;
 
@@ -1352,7 +1352,15 @@ public class MockHttpServletRequest implements HttpServletRequest {
 
 	@Override
 	public boolean isRequestedSessionIdValid() {
-		return this.requestedSessionIdValid;
+		if (this.requestedSessionIdValid != null) {
+			return this.requestedSessionIdValid;
+		}
+		String requestedId = getRequestedSessionId();
+		if (requestedId == null) {
+			return false;
+		}
+		HttpSession currentSession = getSession(false);
+		return (currentSession != null && requestedId.equals(currentSession.getId()));
 	}
 
 	public void setRequestedSessionIdFromCookie(boolean requestedSessionIdFromCookie) {
diff --git a/spring-test/src/test/java/org/springframework/mock/web/MockHttpServletRequestTests.java b/spring-test/src/test/java/org/springframework/mock/web/MockHttpServletRequestTests.java
index 54fb8712e70..dfe68db32e2 100644
--- a/spring-test/src/test/java/org/springframework/mock/web/MockHttpServletRequestTests.java
+++ b/spring-test/src/test/java/org/springframework/mock/web/MockHttpServletRequestTests.java
@@ -714,6 +714,33 @@ class MockHttpServletRequestTests {
 		assertThat(listenerEvent.event.getAsyncContext()).isEqualTo(newAsyncContext);
 	}
 
+	@Test
+	void requestedSessionIdValidShouldDefaultToFalse() {
+		assertThat(request.getRequestedSessionId()).isNull();
+		assertThat(request.isRequestedSessionIdValid()).isFalse();
+	}
+
+	@Test
+	void requestedSessionIdValidShouldReturnTrueWhenSessionValid() {
+		MockHttpSession session = new MockHttpSession();
+		request.setSession(session);
+		request.setRequestedSessionId(session.getId());
+		assertThat(request.getRequestedSessionId()).isEqualTo(session.getId());
+		assertThat(request.isRequestedSessionIdValid()).isTrue();
+	}
+
+	@Test
+	void requestedSessionIdValidShouldReturnFalseWhenRotated() {
+		MockHttpSession session = new MockHttpSession();
+		request.setSession(session);
+		request.setRequestedSessionId(session.getId());
+		String previousRequestedId = request.getRequestedSessionId();
+		request.changeSessionId();
+		assertThat(session.getId()).isNotEqualTo(previousRequestedId);
+		assertThat(request.getRequestedSessionId()).isEqualTo(previousRequestedId);
+		assertThat(request.isRequestedSessionIdValid()).isFalse();
+	}
+
 	private void assertEqualEnumerations(Enumeration<?> enum1, Enumeration<?> enum2) {
 		int count = 0;
 		while (enum1.hasMoreElements()) {
diff --git a/spring-web/src/testFixtures/java/org/springframework/web/testfixture/servlet/MockHttpServletRequest.java b/spring-web/src/testFixtures/java/org/springframework/web/testfixture/servlet/MockHttpServletRequest.java
index 930f5a11074..ddecb632d49 100644
--- a/spring-web/src/testFixtures/java/org/springframework/web/testfixture/servlet/MockHttpServletRequest.java
+++ b/spring-web/src/testFixtures/java/org/springframework/web/testfixture/servlet/MockHttpServletRequest.java
@@ -251,7 +251,7 @@ public class MockHttpServletRequest implements HttpServletRequest {
 
 	private @Nullable HttpSession session;
 
-	private boolean requestedSessionIdValid = true;
+	private @Nullable Boolean requestedSessionIdValid;
 
 	private boolean requestedSessionIdFromCookie = true;
 
@@ -1352,7 +1352,15 @@ public class MockHttpServletRequest implements HttpServletRequest {
 
 	@Override
 	public boolean isRequestedSessionIdValid() {
-		return this.requestedSessionIdValid;
+		if (this.requestedSessionIdValid != null) {
+			return this.requestedSessionIdValid;
+		}
+		String requestedId = getRequestedSessionId();
+		if (requestedId == null) {
+			return false;
+		}
+		HttpSession currentSession = getSession(false);
+		return (currentSession != null && requestedId.equals(currentSession.getId()));
 	}
 
 	public void setRequestedSessionIdFromCookie(boolean requestedSessionIdFromCookie) {