spring-projects / spring-projects/spring-security
SessionRegistryImpl returns principal from expired session
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Summary
SessionRegistryImpl. getAllPrincipals() returns principals from expired sessions.
Actual Behavior
- configure spring security to use max-sessions="1"
- login user in 1 browser (session 1)
- login user in 2 browser (session 2)
- session for user in 1 browser will be expired
- call SessionRegistryImpl. getAllPrincipals(). Principal returned will be from session 1
Expected Behavior
Call SessionRegistryImpl. getAllPrincipals() returns principals only from active session. Such behavior is not documented, however it confused me and caused issue in production. Instead of ".get" (https://github.com/spring-projects/spring-security/blob/a82cab7afdb1fc58830b1c415f1874d36b2c6c92/core/src/main/java/org/springframework/security/core/session/SessionRegistryImpl.java#L125 ) here we could use put. And update result session list if non-null
Version
current.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with SessionRegistryImpl.java and the getAllPrincipals() behavior described in the issue, including the linked line around the current lookup. Reproduce the max-sessions="1" scenario with two browser sessions, then verify that getAllPrincipals() returns only principals from active sessions after the first session expires.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100