CODEWITHSUNDEEP
springspring-securitysession-fixation
xplore
xplore

Reputation: 1

Injecting NullAuthenticatedSessionStrategy in spring security 4.0.1

I am migrating an existing application using spring-security 3.1.3 to 4.0.1. In the current code I see NullAuthenticatedSessionStrategy used as below

<sec:http>
..
<sec:session-management session-authentication-strategy-ref="ss"/>
</sec:http>
<bean id="ss" class="org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy"/>

In our migrated code for 4.0.1 spring security, if i leave the same, it seems the SessionFixationProtectionStrategy is used. So i have switched off the protection using session-fixation-protection=none. 

<sec:session-management session-fixation-protection="none"/>

Q-1; Here i am not clear what is the difference in using NullAuthenticatedSessionStrategy vs that of switching off the protection as above.

Q-2; If i still want to use NullAuthenticatedSessionStrategy as in my current code, how to do that in 4.0.1?

Thanks

Upvotes: 0

Views: 1391

Answers (0)

Related Questions