Merge pull request #16889 from vpavic

* pr/16889:
  Polish "Fix NoClassDefFound when missing Spring Security"
  Fix NoClassDefFound when missing Spring Security

Author: philwebb

spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/session/SessionAutoConfiguration.java

@@ -61,6 +61,7 @@
 import org.springframework.session.web.http.CookieSerializer;
 import org.springframework.session.web.http.DefaultCookieSerializer;
 import org.springframework.session.web.http.HttpSessionIdResolver;
+import org.springframework.util.ClassUtils;
 import org.springframework.util.StringUtils;
 
 /**
@@ -84,6 +85,8 @@
 @AutoConfigureBefore(HttpHandlerAutoConfiguration.class)
 public class SessionAutoConfiguration {
 
+	private static final String REMEMBER_ME_SERVICES_CLASS = "org.springframework.security.web.authentication.RememberMeServices";
+
 	@Configuration
 	@ConditionalOnWebApplication(type = Type.SERVLET)
 	@Import({ ServletSessionRepositoryValidator.class,
@@ -92,8 +95,8 @@ static class ServletSessionConfiguration {
 
 		@Bean
 		@Conditional(DefaultCookieSerializerCondition.class)
-		public DefaultCookieSerializer cookieSerializer(ServerProperties serverProperties,
-				ObjectProvider<SpringSessionRememberMeServices> springSessionRememberMeServices) {
+		public DefaultCookieSerializer cookieSerializer(
+				ServerProperties serverProperties) {
 			Cookie cookie = serverProperties.getServlet().getSession().getCookie();
 			DefaultCookieSerializer cookieSerializer = new DefaultCookieSerializer();
 			PropertyMapper map = PropertyMapper.get().alwaysApplyingWhenNonNull();
@@ -104,9 +107,11 @@ public DefaultCookieSerializer cookieSerializer(ServerProperties serverPropertie
 			map.from(cookie::getSecure).to(cookieSerializer::setUseSecureCookie);
 			map.from(cookie::getMaxAge).to((maxAge) -> cookieSerializer
 					.setCookieMaxAge((int) maxAge.getSeconds()));
-			springSessionRememberMeServices.ifAvailable((
-					rememberMeServices) -> cookieSerializer.setRememberMeRequestAttribute(
-							SpringSessionRememberMeServices.REMEMBER_ME_LOGIN_ATTR));
+			if (ClassUtils.isPresent(REMEMBER_ME_SERVICES_CLASS,
+					getClass().getClassLoader())) {
+				new RememberMeServicesCookieSerializerCustomizer()
+						.apply(cookieSerializer);
+			}
 			return cookieSerializer;
 		}
 
@@ -135,6 +140,19 @@ static class ReactiveSessionRepositoryConfiguration {
 
 	}
 
+	/**
+	 * Customization log for {@link SpringSessionRememberMeServices} that is only
+	 * instantiated when Spring Security is on the classpath.
+	 */
+	static class RememberMeServicesCookieSerializerCustomizer {
+
+		public void apply(DefaultCookieSerializer cookieSerializer) {
+			cookieSerializer.setRememberMeRequestAttribute(
+					SpringSessionRememberMeServices.REMEMBER_ME_LOGIN_ATTR);
+		}
+
+	}
+
 	/**
 	 * Condition to trigger the creation of a {@link DefaultCookieSerializer}. This kicks
 	 * in if either no {@link HttpSessionIdResolver} and {@link CookieSerializer} beans

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/session/AbstractSessionAutoConfigurationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2018 the original author or authors.
+ * Copyright 2012-2019 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,10 +16,16 @@
 
 package org.springframework.boot.autoconfigure.session;
 
+import java.util.Collections;
+
 import org.springframework.boot.test.context.assertj.AssertableReactiveWebApplicationContext;
 import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.session.MapSessionRepository;
 import org.springframework.session.ReactiveSessionRepository;
 import org.springframework.session.SessionRepository;
+import org.springframework.session.config.annotation.web.http.EnableSpringHttpSession;
 import org.springframework.session.web.http.SessionRepositoryFilter;
 import org.springframework.web.server.session.WebSessionManager;
 
@@ -51,4 +57,15 @@ protected <T extends ReactiveSessionRepository<?>> T validateSessionRepository(
 		return type.cast(repository);
 	}
 
+	@Configuration
+	@EnableSpringHttpSession
+	static class SessionRepositoryConfiguration {
+
+		@Bean
+		public MapSessionRepository mySessionRepository() {
+			return new MapSessionRepository(Collections.emptyMap());
+		}
+
+	}
+
 }

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/session/SessionAutoConfigurationWithoutSecurityTests.java

@@ -0,0 +1,55 @@
+/*
+ * Copyright 2012-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.boot.autoconfigure.session;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import org.springframework.boot.autoconfigure.AutoConfigurations;
+import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
+import org.springframework.boot.testsupport.runner.classpath.ClassPathExclusions;
+import org.springframework.boot.testsupport.runner.classpath.ModifiedClassPathRunner;
+import org.springframework.session.web.http.DefaultCookieSerializer;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Tests for {@link SessionAutoConfiguration} when Spring Security is not on the
+ * classpath.
+ *
+ * @author Vedran Pavic
+ */
+@RunWith(ModifiedClassPathRunner.class)
+@ClassPathExclusions("spring-security-*")
+public class SessionAutoConfigurationWithoutSecurityTests
+		extends AbstractSessionAutoConfigurationTests {
+
+	private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner()
+			.withConfiguration(AutoConfigurations.of(SessionAutoConfiguration.class));
+
+	@Test
+	public void sessionCookieConfigurationIsAppliedToAutoConfiguredCookieSerializer() {
+		this.contextRunner.withUserConfiguration(SessionRepositoryConfiguration.class)
+				.run((context) -> {
+					DefaultCookieSerializer cookieSerializer = context
+							.getBean(DefaultCookieSerializer.class);
+					assertThat(cookieSerializer).hasFieldOrPropertyWithValue(
+							"rememberMeRequestAttribute", null);
+				});
+	}
+
+}