Spring Security - Third Edition

SessionFixationProtectionStrategy

SessionFixationProtectionStrategy removed the setRetainedAttributes method in favor of users subclassing SessionFixationProtectionStrategy and overriding the extractAttributes method. Look at the following code:

SessionFixationProtectionStrategy strategy = new SessionFixationProtectionStrategy();strategy.setRetainedAttributes(attrsToRetain);

It should be replaced with:

public class AttrsSessionFixationProtectionStrategy extends SessionFixationProtectionStrategy {      private final Collection<String> attrsToRetain;      public AttrsSessionFixationProtectionStrategy(                  Collection<String> attrsToRetain) {            this.attrsToRetain = attrsToRetain;      }      @Override protected Map<String, Object> extractAttributes(HttpSession session) ...