reset password
Author Message
priyanka.muppuri
Posts: 4
Posted 04:33 Oct 29, 2016 |

 

I am not able to get my previous session after successfully login with spring-security. I read somewhere that spring-security create the new session after login due to security reason.

http://docs.spring.io/spring-security/site/docs/3.0.x/reference/ns-config.html#ns-session-fixation

How do I get previous session ?

 

 

 

 

cysun
Posts: 2935
Posted 09:00 Oct 29, 2016 |

Be a little more specific. What do you mean by "getting previous session"?

BTW, in most cases you don't need to deal with HttpSession directly. To get the current user, do SecurityContextHolder.getContext().getAuthentication().getPrincipal() (see OnCourse for example), and for session attributes use @SessionAttributes.

priyanka.muppuri
Posts: 4
Posted 12:19 Oct 29, 2016 |

just take an example of amazon , user can store the items in shopping cart. And once user is sign up, he is able to see that same cart.

here in my case, Servlet security create the new session after login with it  and all my previous sessions are destroyed. The cart is being saved before the login and  I want to show the same cart once the user has logged in. In your on-course,You did not store anything in session before login.

 

cysun
Posts: 2935
Posted 23:24 Oct 29, 2016 |
priyanka.muppuri wrote:

just take an example of amazon , user can store the items in shopping cart. And once user is sign up, he is able to see that same cart.

here in my case, Servlet security create the new session after login with it  and all my previous sessions are destroyed. The cart is being saved before the login and  I want to show the same cart once the user has logged in. In your on-course,You did not store anything in session before login.

I assume you meant Spring Security when you said "Servlet security".

Spring Security actually uses the existing session (unless you configured it to do otherwise), so if you already have a cart in the session, it should keep it after logging in. I've verified this by adding the attached code to OnCourse. You can test it yourself by adding them to OnCourse and do the following:

  • Go to http://localhost:8080/oncourse/session/set.html - this will set a session attribute.
  • Go to http://localhost:8080/oncourse/session/get.html - this should show the value of the session attribute, which should be "world".
  • Log in
  • Go to http://localhost:8080/oncourse/session/get.html again - this should show "world" again, meaning that login does not remove the existing session.
  • Log out
  • Go to http://localhost:8080/oncourse/session/get.html again - this should show nothing, meaning the session is destroyed after logging out and the session attribute is gone.
Last edited by cysun at 23:25 Oct 29, 2016.