shopping cart data lost after login

[sam White]

Hi, I am using spring mvc 3/4+, with spring security.

Before login, I added some data to the shoppign cart (with session annotated), and then login.
After login, shopping cart becomes enpty.
I think session id is changed, so data in cart is all gone.

With spring security, is there any way I can copy all data from shopping cart to new session before refresh ssession by spring security ?


Here is security-config.xml:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:tx="http://www.springframework.org/schema/tx"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
                http://www.springframework.org/schema/beans/spring-beans-3.2.xsd       
                http://www.springframework.org/schema/context      
                http://www.springframework.org/schema/context/spring-context-3.2.xsd     
                http://www.springframework.org/schema/tx      
                http://www.springframework.org/schema/tx/spring-tx-3.2.xsd  
                http://www.springframework.org/schema/security     
                http://www.springframework.org/schema/security/spring-security-3.2.xsd">

    <!-- Configure Spring Security -->
    <security:http auto-config="true" use-expressions="true" access-denied-page="/login">
        <security:intercept-url pattern="/login" access="permitAll"/>
        <security:intercept-url pattern="/checkout" access="permitAll"/>
        <security:intercept-url pattern="/my-account/*" access="hasRole('ROLE_USER')"/>
<!--        <security:intercept-url pattern="/partner/*" access="hasRole('ROLE_PARTNER')"/>
        <security:intercept-url pattern="/admin/*" access="hasRole('ROLE_ADMIN')"/>-->

        <security:intercept-url pattern="/ckeditor/*" access="hasRole('ROLE_ADMIN')"/>

        <!--                <security:intercept-url pattern="/j_spring_security_check" access="ROLE_SUPERVISOR" />-->
        <security:form-login
                login-page="/login"
                authentication-failure-url="/login?error=true"
                default-target-url="/"
                authentication-success-handler-ref="customerSimpleUrlAuthenticationSuccessHandler"/>

        <security:logout
                invalidate-session="true"
                logout-success-url="/"
                logout-url="/logout"/>
    </security:http>
    
<!--    <security:http auto-config="true" use-expressions="true" access-denied-page="/checkout">
        <security:intercept-url pattern="/checkout" access="permitAll"/>
        <security:intercept-url pattern="/my-account/*" access="permitAll"/>
        <security:intercept-url pattern='/**' access="permitAll"/>

        <security:intercept-url pattern="/ckeditor/*" access="hasRole('ROLE_ADMIN')"/>

                        <security:intercept-url pattern="/j_spring_security_check" access="ROLE_SUPERVISOR" />
        <security:form-login
                login-page="/checkout"
                authentication-failure-url="/checkout?error=true"
                default-target-url="/"
                authentication-success-handler-ref="customerSimpleUrlAuthenticationSuccessHandler"/>

        <security:logout
                invalidate-session="true"
                logout-success-url="/"
                logout-url="/auth/logout"/>
    </security:http>-->

    <bean id="customerSimpleUrlAuthenticationSuccessHandler"
          class="morfeusflex_client.service.auth.CustomerSavedRequestAwareAuthenticationSuccessHandler">
        <property name="defaultUserUrl" value="/"/>
    </bean>

    <security:authentication-manager>
        <!-- Declare an authentication-manager to use a custom userDetailsService -->
        <security:authentication-provider user-service-ref="customUserDetailsService">
            <security:password-encoder ref="passwordEncoder"/>
        </security:authentication-provider>
    </security:authentication-manager>

    <context:annotation-config/>
    <!-- Use a Md5 encoder since the user's passwords are stored as Md5 in the database -->
    <!--<bean class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" id="passwordEncoder"/>-->
    <!-- use BCrypt encoder -->
    <bean class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" id="passwordEncoder"/>
    <!-- A custom service where Spring will retrieve users and their corresponding access levels  -->
    <bean id="customUserDetailsService" class="morfeusflex_client.service.auth.CustomUserDetailsService"/>

    <context:component-scan base-package="morfeusflex_client" annotation-config="true"/>
</beans>

[sam White]

I 'd like to further explain the issue:
Before login, user added items to the shopping cart.
When user checkout, user decided to login first, but after login, all purchased items in the shopping cart is gone.

Here is my shoppingCartServiceIimpl java class:

@Service("shoppingCartService")
@Scope(value="session", proxyMode=ScopedProxyMode.TARGET_CLASS)
public class ShoppingCartServiceImpl implements ShoppingCartService {

This data lost may be caused by spring security changed the session .

Now, is there any way I can keep/find the session obj before user login, and copy the shopping cart data to the new session after user login?

Thank you for your help again
Sam