Who creates the JSESSIONID cookie in Spring Security?

Question

In my web application theres the requirement that each locale (accessible under the paths /de_DE/ , /en_US/ etc.) respectively has it's own session. I did this by overwriting the session CookieGenerator so that it sets a path for the session cookies, so the browser sends the right session id for the accessed locale.

The problem I have now is that Spring Security changes the session ID after the login and generates a new session cookie somewhere. This cookie doesn't have the path I want it to. Where can I manipulate how Spring generates the session cookie?

Answer 1

查看SessionManagementFilter ，这里所有与会话相关的活动都是在SessionAuthenticationStretegy类的帮助下发生的。