jetty / jetty.project

Eclipse Jetty® - Web Container & Clients - supports HTTP/2, HTTP/1.1, HTTP/1.0, websocket, servlets, and more
https://eclipse.dev/jetty
Other
3.86k stars 1.91k forks source link

`SessionAuthentication._session` is not marked as `transient` #12309

Closed janbartel closed 1 month ago

janbartel commented 1 month ago

Jetty version(s) jetty-12.0.x

Jetty Environment core security

The org.eclipse.jetty.security.authentication.SessionAuthentication class has a HttpSession _session data member which must be marked as transient to prevent it being serialized. This keyword is missing.