org.seedstack.seed.web.security

Interface SessionRegeneratingFilter

All Superinterfaces:

javax.servlet.Filter

public interface SessionRegeneratingFilter
extends javax.servlet.Filter

This interface can be implemented in any authenticating Shiro filter to add subject session regeneration capability. Typically this is done by overriding the onLoggingSuccess() method of such filter to call the regenerateSession(Subject) method before invoking normal behavior:

  @Override
 protected boolean onLoginSuccess(AuthenticationToken token, Subject subject, ServletRequest request,
         ServletResponse response) throws Exception {
     regenerateSession(subject);
     return super.onLoginSuccess(token, subject, request, response);
 }
 

Method Summary

Modifier and Type	Method and Description
default void	regenerateSession(org.apache.shiro.subject.Subject subject) Regenerate the session if any.

Methods inherited from interface javax.servlet.Filter

destroy, doFilter, init

Method Detail

regenerateSession

default void regenerateSession(org.apache.shiro.subject.Subject subject)

Regenerate the session if any. This prevents a potential session fixation issue by forcing a new session id on login success. See https://issues.apache.org/jira/browse/SHIRO-170.

Parameters:

subject - the successfully logged in subject