SpringSource/spring-security — pull request #35 by beamerblvd (2013-06-15 04:16:35+00:00)
Title: Added support for Servlet 3.1's changeSessionId()

Added support for Servlet 3.1's `HttpServletRequest#changeSessionId()` method as another approach to session fixation protection. This has a big advantage in that it avoids all the issues with the `SessionBindingEventListener` that are cause by the "new session" and "migrate session" approaches. As such, Spring Security now detects if it is running in a Servlet 3.1 or newer container and uses this new method as the default. "Migration" is still the default in older containers.

As agreed upon in the comments to SEC-2135, the changes involved deprecating the old `SessionFixationProtectionStrategy` and `ConcurrentSessionControlStrategy` and replacing them. This way, anyone manually using the legacy system will continue to observe the same behavior with only compile warnings about deprecation, and people currently using the namespace configuration will transparently start using the new system. An enum was created (`SessionFixationProtectionScheme`) to specify the session fixation protection scheme that should be used. This allows for direct mapping between the namespace attribute value and the enum constant, and also provides support for future programmatic `@Configuration`.

The changes include thorough documentation and lots of unit tests.

By consequence, this also fixes SEC-2137.

Issues: SEC-2135, SEC-2137