1

In my code I am using spring direct login.

Once controller switches between https to http a new session is created, once new session is created, how do I pass/ copy the session attribute to new session Which was created by http?

brimborium
  • 9,362
  • 9
  • 48
  • 76
Lakshmikanth
  • 11
  • 1

1 Answers1

0

Check the Spring Security FAQ. Basically, you can't copy the session attributes - all the session data from the previous is lost when you switch back to HTTP. Since the browser won't send the secure cookie, you have a new session and it's as if you hadn't logged in at all.

There are ways of working around this (see the FAQ for more details and search the web) but they are generally a bad idea. You should start in HTTPS and stay that way if security is important.

Shaun the Sheep
  • 22,353
  • 1
  • 72
  • 100