web/src/main/java/org/springframework/security/web/authentication/session/AbstractSessionFixationProtectionStrategy.java
public void onAuthentication(Authentication authentication,
			HttpServletRequest request, HttpServletResponse response) {
		boolean hadSessionAlready = request.getSession(false) != null;

		if (!hadSessionAlready && !alwaysCreateSession) {
			// Session fixation isn't a problem if there's no session

			return;
		}

		// Create new session if necessary
		HttpSession session = request.getSession();

		if (hadSessionAlready && request.isRequestedSessionIdValid()) {

			String originalSessionId;
			String newSessionId;
			Object mutex = WebUtils.getSessionMutex(session);
			synchronized (mutex) {
				// We need to migrate to a new session
				originalSessionId = session.getId();

				session = applySessionFixation(request);
				newSessionId = session.getId();
			}

			if (originalSessionId.equals(newSessionId)) {
				logger.warn("Your servlet container did not change the session ID when a new session was created. You will"
						+ " not be adequately protected against session-fixation attacks");
			}

			onSessionChange(originalSessionId, session, authentication);
		}
	}
public void onAuthentication(Authentication authentication,
			HttpServletRequest request, HttpServletResponse response) {
		boolean hadSessionAlready = request.getSession(false) != null;

		if (!hadSessionAlready && !alwaysCreateSession) {
			// Session fixation isn't a problem if there's no session

			return;
		}

		// Create new session if necessary
		HttpSession session = request.getSession();

		if (hadSessionAlready && request.isRequestedSessionIdValid()) {

			String originalSessionId;
			String newSessionId;
			Object mutex = WebUtils.getSessionMutex(session);
			synchronized (mutex) {
				// We need to migrate to a new session
				originalSessionId = session.getId();

				session = applySessionFixation(request);
				newSessionId = session.getId();
			}

			if (originalSessionId.equals(newSessionId)) {
				logger.warn("Your servlet container did not change the session ID when a new session was created. You will"
						+ " not be adequately protected against session-fixation attacks");
			}

			onSessionChange(originalSessionId, session, authentication);
		}
	}
public void onAuthentication ( Authentication authentication , HttpServletRequest request , HttpServletResponse response ) { boolean hadSessionAlready = request . getSession ( false ) != null ; if ( ! hadSessionAlready && ! alwaysCreateSession ) { // Session fixation isn't a problem if there's no session return ; } // Create new session if necessary HttpSession session = request . getSession ( ) ; if ( hadSessionAlready && request . isRequestedSessionIdValid ( ) ) { String originalSessionId ; String newSessionId ; Object mutex = WebUtils . getSessionMutex ( session ) ; synchronized ( mutex ) { // We need to migrate to a new session originalSessionId = session . getId ( ) ; session = applySessionFixation ( request ) ; newSessionId = session . getId ( ) ; } if ( originalSessionId . equals ( newSessionId ) ) { logger . warn ( "Your servlet container did not change the session ID when a new session was created. You will" + " not be adequately protected against session-fixation attacks" ) ; } onSessionChange ( originalSessionId , session , authentication ) ; } }
Called when a user is newly authenticated.
<p>
If a session already exists, and matches the session Id from the client, a new
session will be created, and the session attributes copied to it (if
{@code migrateSessionAttributes} is set). If the client's requested session Id is
invalid, nothing will be done, since there is no need to change the session Id if
it doesn't match the current session.
<p>
If there is no session, no action is taken unless the {@code alwaysCreateSession}
property is set, in which case a session will be created if one doesn't already
exist.
Called when a user is newly authenticated . <p > If a session already exists and matches the session Id from the client a new session will be created and the session attributes copied to it ( if {