Add createdTime field to SessionInformation

Closes: gh-17359
Signed-off-by: Andrey Litvitski <[email protected]>

Author: therepanic

core/src/main/java/org/springframework/security/core/session/SessionInformation.java

@@ -36,6 +36,7 @@
  * <code>Filter</code>.
  *
  * @author Ben Alex
+ * @author Andrey Litvitski
  */
 public class SessionInformation implements Serializable {
 
@@ -49,13 +50,17 @@ public class SessionInformation implements Serializable {
 
 	private boolean expired = false;
 
-	public SessionInformation(Object principal, String sessionId, Date lastRequest) {
+	private final Date createdTime;
+
+	public SessionInformation(Object principal, String sessionId, Date lastRequest, Date createdTime) {
 		Assert.notNull(principal, "Principal required");
 		Assert.hasText(sessionId, "SessionId required");
 		Assert.notNull(lastRequest, "LastRequest required");
+		Assert.notNull(lastRequest, "CreatedTime required");
 		this.principal = principal;
 		this.sessionId = sessionId;
 		this.lastRequest = lastRequest;
+		this.createdTime = createdTime;
 	}
 
 	public void expireNow() {
@@ -74,6 +79,10 @@ public String getSessionId() {
 		return this.sessionId;
 	}
 
+	public Date getCreatedTime() {
+		return this.createdTime;
+	}
+
 	public boolean isExpired() {
 		return this.expired;
 	}

core/src/main/java/org/springframework/security/core/session/SessionRegistryImpl.java

@@ -133,7 +133,9 @@ public void registerNewSession(String sessionId, Object principal) {
 		if (this.logger.isDebugEnabled()) {
 			this.logger.debug(LogMessage.format("Registering session %s, for principal %s", sessionId, principal));
 		}
-		this.sessionIds.put(sessionId, new SessionInformation(principal, sessionId, new Date()));
+		Date currentDate = new Date();
+		this.sessionIds.put(sessionId, new SessionInformation(principal, sessionId, new Date(currentDate.getTime()),
+				new Date(currentDate.getTime())));
 		this.principals.compute(principal, (key, sessionsUsedByPrincipal) -> {
 			if (sessionsUsedByPrincipal == null) {
 				sessionsUsedByPrincipal = new CopyOnWriteArraySet<>();

core/src/test/java/org/springframework/security/core/session/SessionInformationTests.java

@@ -26,6 +26,7 @@
  * Tests {@link SessionInformation}.
  *
  * @author Ben Alex
+ * @author Andrey Litvitski
  */
 public class SessionInformationTests {
 
@@ -34,10 +35,12 @@ public void testObject() throws Exception {
 		Object principal = "Some principal object";
 		String sessionId = "1234567890";
 		Date currentDate = new Date();
-		SessionInformation info = new SessionInformation(principal, sessionId, currentDate);
+		SessionInformation info = new SessionInformation(principal, sessionId, new Date(currentDate.getTime()),
+				new Date(currentDate.getTime()));
 		assertThat(info.getPrincipal()).isEqualTo(principal);
 		assertThat(info.getSessionId()).isEqualTo(sessionId);
 		assertThat(info.getLastRequest()).isEqualTo(currentDate);
+		assertThat(info.getCreatedTime()).isEqualTo(currentDate);
 		Thread.sleep(10);
 		info.refreshLastRequest();
 		assertThat(info.getLastRequest().after(currentDate)).isTrue();

web/src/test/java/org/springframework/security/web/authentication/session/ConcurrentSessionControlAuthenticationStrategyTests.java

@@ -70,7 +70,7 @@ public void setup() {
 		this.request = new MockHttpServletRequest();
 		this.response = new MockHttpServletResponse();
 		this.sessionInformation = new SessionInformation(this.authentication.getPrincipal(), "unique",
-				new Date(1374766134216L));
+				new Date(1374766134216L), new Date());
 		this.strategy = new ConcurrentSessionControlAuthenticationStrategy(this.sessionRegistry);
 	}
 
@@ -123,7 +123,7 @@ public void maxSessionsExpireExistingUser() {
 	@Test
 	public void maxSessionsExpireLeastRecentExistingUser() {
 		SessionInformation moreRecentSessionInfo = new SessionInformation(this.authentication.getPrincipal(), "unique",
-				new Date(1374766999999L));
+				new Date(1374766999999L), new Date());
 		given(this.sessionRegistry.getAllSessions(any(), anyBoolean()))
 			.willReturn(Arrays.<SessionInformation>asList(moreRecentSessionInfo, this.sessionInformation));
 		this.strategy.setMaximumSessions(2);
@@ -134,9 +134,9 @@ public void maxSessionsExpireLeastRecentExistingUser() {
 	@Test
 	public void onAuthenticationWhenMaxSessionsExceededByTwoThenTwoSessionsExpired() {
 		SessionInformation oldestSessionInfo = new SessionInformation(this.authentication.getPrincipal(), "unique1",
-				new Date(1374766134214L));
+				new Date(1374766134214L), new Date());
 		SessionInformation secondOldestSessionInfo = new SessionInformation(this.authentication.getPrincipal(),
-				"unique2", new Date(1374766134215L));
+				"unique2", new Date(1374766134215L), new Date());
 		given(this.sessionRegistry.getAllSessions(any(), anyBoolean())).willReturn(
 				Arrays.<SessionInformation>asList(oldestSessionInfo, secondOldestSessionInfo, this.sessionInformation));
 		this.strategy.setMaximumSessions(2);
@@ -196,7 +196,7 @@ public void maxSessionsExpireExistingUserUsingSessionLimit() {
 	@Test
 	public void maxSessionsExpireLeastRecentExistingUserUsingSessionLimit() {
 		SessionInformation moreRecentSessionInfo = new SessionInformation(this.authentication.getPrincipal(), "unique",
-				new Date(1374766999999L));
+				new Date(1374766999999L), new Date());
 		given(this.sessionRegistry.getAllSessions(any(), anyBoolean()))
 			.willReturn(Arrays.asList(moreRecentSessionInfo, this.sessionInformation));
 		this.strategy.setMaximumSessions(SessionLimit.of(2));
@@ -207,9 +207,9 @@ public void maxSessionsExpireLeastRecentExistingUserUsingSessionLimit() {
 	@Test
 	public void onAuthenticationWhenMaxSessionsExceededByTwoThenTwoSessionsExpiredUsingSessionLimit() {
 		SessionInformation oldestSessionInfo = new SessionInformation(this.authentication.getPrincipal(), "unique1",
-				new Date(1374766134214L));
+				new Date(1374766134214L), new Date());
 		SessionInformation secondOldestSessionInfo = new SessionInformation(this.authentication.getPrincipal(),
-				"unique2", new Date(1374766134215L));
+				"unique2", new Date(1374766134215L), new Date());
 		given(this.sessionRegistry.getAllSessions(any(), anyBoolean()))
 			.willReturn(Arrays.asList(oldestSessionInfo, secondOldestSessionInfo, this.sessionInformation));
 		this.strategy.setMaximumSessions(SessionLimit.of(2));

web/src/test/java/org/springframework/security/web/concurrent/ConcurrentSessionFilterTests.java

@@ -276,7 +276,7 @@ public void setLogoutHandlersWhenEmptyThenThrowsException() {
 	private SessionRegistry mockSessionRegistry() {
 		SessionRegistry registry = mock(SessionRegistry.class);
 		SessionInformation information = new SessionInformation("user", "sessionId",
-				new Date(System.currentTimeMillis() - 1000));
+				new Date(System.currentTimeMillis() - 1000), new Date());
 		information.expireNow();
 		given(registry.getSessionInformation(anyString())).willReturn(information);
 		return registry;

web/src/test/java/org/springframework/security/web/session/SessionInformationExpiredEventTests.java

@@ -43,20 +43,22 @@ public void constructorWhenSessionInformationNullThenThrowsException() {
 	@Test
 	public void constructorWhenRequestNullThenThrowsException() {
 		assertThatIllegalArgumentException().isThrownBy(() -> new SessionInformationExpiredEvent(
-				new SessionInformation("fake", "sessionId", new Date()), null, new MockHttpServletResponse()));
+				new SessionInformation("fake", "sessionId", new Date(), new Date()), null,
+				new MockHttpServletResponse()));
 	}
 
 	@Test
 	public void constructorWhenResponseNullThenThrowsException() {
 		assertThatIllegalArgumentException().isThrownBy(() -> new SessionInformationExpiredEvent(
-				new SessionInformation("fake", "sessionId", new Date()), new MockHttpServletRequest(), null));
+				new SessionInformation("fake", "sessionId", new Date(), new Date()), new MockHttpServletRequest(),
+				null));
 	}
 
 	@Test
 	void constructorWhenFilterChainThenGetFilterChainReturnsNotNull() {
 		MockFilterChain filterChain = new MockFilterChain();
 		SessionInformationExpiredEvent event = new SessionInformationExpiredEvent(
-				new SessionInformation("fake", "sessionId", new Date()), new MockHttpServletRequest(),
+				new SessionInformation("fake", "sessionId", new Date(), new Date()), new MockHttpServletRequest(),
 				new MockHttpServletResponse(), filterChain);
 		assertThat(event.getFilterChain()).isSameAs(filterChain);
 	}