SessionFixationProtectionStrategy ignores create-session="never"

Summary

The SessionFixationProtectionStrategy class creates a new session, even if you have configured create-session="never".

Actual Behavior

The use case is that you want different urls to behave differently. For example:

Urls from "/example_1/" should not create a new session, but should use one if it exists
Urls from "/example_2/" should create a session "if required"

Because the SessionFixationProtectionStrategy assumes that you always want to create a session if one already exists then this makes this desired behavior impossible.

This line is the culprit:

session = request.getSession(true); // we now have a new session

Expected Behavior

SessionFixationProtectionStrategy should not ignore create-session="never"

(The session should still be invalidated - just not a new one created)

Configuration

create-session="never" for some URLs and create-session="ifRequired" for otehr URLs.

Version

spring-security-web-3.2.5

Start by reading SessionFixationProtectionStrategy, especially the request.getSession(true) path described in the issue, and trace how create-session="never" is applied for URL configuration. Reproduce the contrasting URL behavior with create-session="never" and create-session="ifRequired"; done means the existing session is invalidated without creating a replacement for the former case.