> Rob, there is no such thing as NullEventPublisher in Spring Framework or Spring Security. There are no implementations of ApplicationEventPublisher that I can find in either framework that do what you're suggesting. 

It is private, but [NullEventPublisher](https://github.com/SpringSource/spring-security/blob/7edb1089a80ea7a29adb6d01c091e6fa55d61b39/core/src/main/java/org/springframework/security/authentication/ProviderManager.java#L300) does exist. You will want to copy the implementation and keep it private. It can be found inside Eclipse use Shift+Ctrl+T and inside IntelliJ use Ctrl+N You can also enter the following search into github to find it `@SpringSource/spring-security NullEventPublisher` 

> Additionally, Spring Security classes ...

The concern here is passivity. As the code stands today if I created SessionFixationProtectionStrategy outside of the Spring container I would not need to inject an ApplicationEventPublisher for it to work. With these changes I would need to inject it to prevent a NullPointerException