@@ -444,10 +444,10 @@ public Session getSession(HttpServletRequest request) {
444444 * Gets the Session ID specification from the current request following this
445445 * lookup strategy:
446446 * <ol>
447- * <li>Session attribute <code>PARAM_SID</code></li>
448- * <li>Request attribute <code>PARAM_SID</code></li>
449447 * <li>Request parameter <code>PARAM_SID</code></li>
450448 * <li>Request header <code>PARAM_SID</code></li>
449+ * <li>Request attribute <code>PARAM_SID</code></li>
450+ * <li>Session attribute <code>PARAM_SID</code></li>
451451 * <li>Cookie <code>COOKIE_SID</code></li>
452452 * <li>Spring SecurityContextHolder</li>
453453 * <li>Client ID</li>
@@ -481,20 +481,20 @@ private String getSessionIdFromRequest(HttpServletRequest request) {
481481 return null ;
482482
483483 String sid = null ;
484- if (request .getSession (true ).getAttribute (PARAM_SID ) != null
485- && StringUtils .isNotEmpty ((String ) request .getSession (true ).getAttribute (PARAM_SID )))
486- sid = (String ) request .getSession (true ).getAttribute (PARAM_SID );
487- else if (request .getAttribute (PARAM_SID ) != null
488- && StringUtils .isNotEmpty ((String ) request .getAttribute (PARAM_SID )))
489- sid = (String ) request .getAttribute (PARAM_SID );
490- else if (StringUtils .isNotEmpty (request .getParameter (PARAM_SID ))
484+ if (StringUtils .isNotEmpty (request .getParameter (PARAM_SID ))
491485 && Context .get ().getProperties ().getBoolean ("security.acceptsid" , false ))
492486 sid = request .getParameter (PARAM_SID );
493487 else if (StringUtils .isNotEmpty (request .getHeader (PARAM_SID )))
494488 sid = request .getHeader (PARAM_SID );
495- else {
489+ else if (request .getAttribute (PARAM_SID ) != null
490+ && StringUtils .isNotEmpty ((String ) request .getAttribute (PARAM_SID )))
491+ sid = (String ) request .getAttribute (PARAM_SID );
492+ else if (request .getSession (true ).getAttribute (PARAM_SID ) != null
493+ && StringUtils .isNotEmpty ((String ) request .getSession (true ).getAttribute (PARAM_SID )))
494+ sid = (String ) request .getSession (true ).getAttribute (PARAM_SID );
495+ else
496496 sid = getSessionIdFromCookie (request );
497- }
497+
498498 return sid ;
499499 }
500500
0 commit comments