SEC-1590: Removed WebAuthenticatioDetails.doPopulateAdditionalInformation() method which is caled from superclass constructor.

web/src/main/java/org/springframework/security/web/authentication/WebAuthenticationDetails.java

@@ -24,6 +24,7 @@ import javax.servlet.http.HttpSession;
  * A holder of selected HTTP details related to a web authentication request.
  *
  * @author Ben Alex
+ * @author Luke Taylor
  */
 public class WebAuthenticationDetails implements Serializable {
     //~ Instance fields ================================================================================================
@@ -44,19 +45,10 @@ public class WebAuthenticationDetails implements Serializable {
 
         HttpSession session = request.getSession(false);
         this.sessionId = (session != null) ? session.getId() : null;
-
-        doPopulateAdditionalInformation(request);
     }
 
     //~ Methods ========================================================================================================
 
-    /**
-     * Provided so that subclasses can populate additional information.
-     *
-     * @param request that the authentication request was received from
-     */
-    protected void doPopulateAdditionalInformation(HttpServletRequest request) {}
-
     public boolean equals(Object obj) {
         if (obj instanceof WebAuthenticationDetails) {
             WebAuthenticationDetails rhs = (WebAuthenticationDetails) obj;