0

I have the following scenario:

  1. I access to a web application - that makes use of spring security, create an object in session, let us say a cart with some entries.
  2. I access the application using a restful client. I do have: user, password, JSESSIONID cookie with its corresponding value. Both are using basic authentication.

The result? I get the object - the cart on this case - but it comes empty. It does not have the entries that were added. It is almost like - even though I was able to authenticate successfully there is a mechanism in place that creates a new instance of the object, instead of giving me the existing one.

Do you have any idea of spring security is somehow not allowing this to happen.

I also noticed that... I send the Cookie JSESSIONID=Number and when it responds it gives me a different Number for JSESSIONID, my assumption is that even though I have the wright credentials and it allows me to log in, it does not allow me to use the same session, it simply creates a new one and my cart is empty there.

Any help will be greatly appreciated!

Michael
  • 10,063
  • 18
  • 65
  • 104
user1532449
  • 322
  • 4
  • 14

2 Answers2

0

SpringSecurity replaces JSESSIONID cookie after the authentication (and it is strongly recommended not to disable the feature to prevent the Session Fixation attack). The following configuration enables the feature

<http ...>
    ...
    <session-management session-fixation-protection="migrateSession" />
</http>

To copy the the existing session attributes use migrateSession.

The attributes values according to the documentation http://static.springsource.org/spring-security/site/docs/3.2.x/reference/springsecurity-single.html#session-mgmt :

  • migrateSession - creates a new session and copies the existing session attributes to the new session. This is the default.
  • none - Don't do anything. The original session will be retained.
  • newSession - Create a new "clean" session, without copying the existing session data.
Michael
  • 10,063
  • 18
  • 65
  • 104
0

Spring creates a new session on authentication. This is called Session Fixation Protection. Read more about it here:

kevin847
  • 1,058
  • 1
  • 7
  • 15
  • Thank you very much Kevin. I already removed the protection for that by doing the following: Here is what I am doing: 1.- Access the web app, 2.- Get the value for the JSESSIONID cookie, 3.- Access with a RESTFul client, using the same credentials, authentication (basic) and I send the JSESSIONID cookie with the value I got at 2. But still, even though I can authenticate it always creates a new session and therefore my cart comes back empty. Any idea of how to overcome this? Thanks again for your kind help! – user1532449 May 02 '13 at 18:19
  • Can you share your spring security configuration? – kevin847 May 02 '13 at 21:16