[SECURITY-442] Prevent session fixation attack

jenkinsci · Apr 12, 2018 · d8d673f · d8d673f
1 parent 2f95fae
commit d8d673f
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/src/main/java/org/jenkinsci/plugins/googlelogin/GoogleOAuth2SecurityRealm.java b/src/main/java/org/jenkinsci/plugins/googlelogin/GoogleOAuth2SecurityRealm.java
@@ -60,6 +60,7 @@
 import org.kohsuke.stapler.HttpRedirect;
 import org.kohsuke.stapler.HttpResponse;
 import org.kohsuke.stapler.QueryParameter;
+import org.kohsuke.stapler.Stapler;
 import org.kohsuke.stapler.StaplerRequest;
 
 import java.io.IOException;
@@ -201,6 +202,11 @@ public void initialize(HttpRequest request) throws IOException {
                     // logs this user in.
                     UsernamePasswordAuthenticationToken token =
                             new UsernamePasswordAuthenticationToken(info.getEmail(), "", authorities);
+
+                    // prevent session fixation attack
+                    Stapler.getCurrentRequest().getSession().invalidate();
+                    Stapler.getCurrentRequest().getSession();
+
                     SecurityContextHolder.getContext().setAuthentication(token);
                     // update the user profile.
                     User u = User.get(token.getName());