Prevent NullPointerException when session ID changes

The old session ID may not exist in the session registry if the user is not authenticated. Closes spring-projectsgh-9011
vpavic · Sep 18, 2020 · a5b97bb · a5b97bb
1 parent 6e6d382
commit a5b97bb
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 3 deletions.
diff --git a/core/src/main/java/org/springframework/security/core/session/SessionRegistryImpl.java b/core/src/main/java/org/springframework/security/core/session/SessionRegistryImpl.java
@@ -108,9 +108,11 @@ public void onApplicationEvent(AbstractSessionEvent event) {
 		else if (event instanceof SessionIdChangedEvent) {
 			SessionIdChangedEvent sessionIdChangedEvent = (SessionIdChangedEvent) event;
 			String oldSessionId = sessionIdChangedEvent.getOldSessionId();
-			Object principal = this.sessionIds.get(oldSessionId).getPrincipal();
-			removeSessionInformation(oldSessionId);
-			registerNewSession(sessionIdChangedEvent.getNewSessionId(), principal);
+			if (this.sessionIds.containsKey(oldSessionId)) {
+				Object principal = this.sessionIds.get(oldSessionId).getPrincipal();
+				removeSessionInformation(oldSessionId);
+				registerNewSession(sessionIdChangedEvent.getNewSessionId(), principal);
+			}
 		}
 	}
 

diff --git a/core/src/test/java/org/springframework/security/core/session/SessionRegistryImplTests.java b/core/src/test/java/org/springframework/security/core/session/SessionRegistryImplTests.java
@@ -173,6 +173,25 @@ public void testTwoSessionsOnePrincipalHandling() {
 		assertThat(this.sessionRegistry.getAllSessions(principal, false)).isEmpty();
 	}
 
+	@Test
+	public void sessionIdChangedEventWhenSessionIdNotSavedThenDoesNothing() {
+		final String oldSessionId = "old-session-id";
+		final String newSessionId = "new-session-id";
+		this.sessionRegistry.onApplicationEvent(new SessionIdChangedEvent("") {
+			@Override
+			public String getOldSessionId() {
+				return oldSessionId;
+			}
+
+			@Override
+			public String getNewSessionId() {
+				return newSessionId;
+			}
+		});
+		assertThat(this.sessionRegistry.getSessionInformation(oldSessionId)).isNull();
+		assertThat(this.sessionRegistry.getSessionInformation(newSessionId)).isNull();
+	}
+
 	private boolean contains(String sessionId, Object principal) {
 		List<SessionInformation> info = this.sessionRegistry.getAllSessions(principal, false);
 		for (SessionInformation sessionInformation : info) {