Skip to content

Isolate known attribute names for type-based @SessionAttributes by handler type#37070

Open
froggy0m0 wants to merge 1 commit into
spring-projects:mainfrom
froggy0m0:fix/session-attributes-handler
Open

Isolate known attribute names for type-based @SessionAttributes by handler type#37070
froggy0m0 wants to merge 1 commit into
spring-projects:mainfrom
froggy0m0:fix/session-attributes-handler

Conversation

@froggy0m0

Copy link
Copy Markdown
Contributor

Problem

SessionAttributesHandler manages the session attributes that a specific handler declares through @SessionAttributes.

With type-based @SessionAttributes, the actual model attribute names are discovered at runtime.
SessionAttributesHandler therefore stores these known attribute names in the session
so they can be restored in distributed session scenarios.

However, all handler types currently store their known attribute names under the same SESSION_KNOWN_ATTRIBUTE key.
As a result, one handler can treat names recorded by another handler as its own.

Consequently, one handler can restore session attributes managed by another.
If that handler subsequently calls SessionStatus#setComplete(),
the cleanup that follows can also remove session attributes managed by the original handler.

Changes

Include the handler type name in the session key used to store and restore known attribute names.

This keeps the known attribute names for type-based @SessionAttributes isolated by handler type.
It does not change how the actual session attributes are stored or how name-based
@SessionAttributes declarations behave.

Tests

Add regression tests that verify the following:

  • Session attributes managed by a different handler type are not restored.
  • Cleanup for one handler type does not remove session attributes managed by another handler type.

I would appreciate your review of these changes. I can make changes if needed.

Known attribute names for type-based @SessionAttributes were stored
under a shared session key. This allowed one handler to retrieve or
remove attributes managed by another.

Store the names using a handler-type-specific session key instead.

Signed-off-by: Sunghyun Shin <79225728+froggy0m0@users.noreply.github.com>
@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged or decided on label Jul 19, 2026
@sbrannen sbrannen added the in: web Issues in web modules (web, webmvc, webflux, websocket) label Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in: web Issues in web modules (web, webmvc, webflux, websocket) status: waiting-for-triage An issue we've not yet triaged or decided on

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants