SessionRepositoryFilter#changeSessionId does not copy the previous maxInactiveInterval into the new session #951
Description
When using SpringSession with ChangeSessionIdAuthenticationStrategy the SessionRepositoryFilter's method, changeSessionId, is invoked. In this code the session variable and the original variable are a reference to the same object, so in the following code extracted from SessionRepositoryFilter.changeSessionId
HttpSessionWrapper newSession = getSession();
original.setSession(newSession.getSession());
newSession.setMaxInactiveInterval(session.getMaxInactiveInterval());
in the second line we are effectively overwriting the internal session object of the same HttpSessionWrapper, referenced by our original AND session variables.
So in the third line we have lost the reference to the previously stored maxInactiveInterval value
The solution is as simply as
HttpSessionWrapper newSession = getSession();
int previousValue = session.getMaxInactiveInterval();
original.setSession(newSession.getSession());
newSession.setMaxInactiveInterval(previousValue);