Package de.businesscode.bcdui.subjectsettings.services

Class RequestSession

java.lang.Object
de.businesscode.bcdui.subjectsettings.services.RequestSession
All Implemented Interfaces:
AutoCloseable
public class RequestSession extends Object implements AutoCloseable
Scopes a Shiro login to just the current request: logs in the given (not yet verified - see OnBehalfIdentityRealm) on-behalf-of identity assertion, binds the resulting Subject to the current thread, and on close() unbinds it again and destroys any session that got created along the way - so these short-lived, per-call sessions never outlive the request or linger in the session store until they time out naturally. Refuses to even start if the request already presents a session id (valid or not - a trusted caller here is a machine, not a browser, so it must never send one). That alone is the guarantee that matters: a request can only ever become associated with a session either because the client presented an id for an existing one, or because something creates one fresh during this very request's own processing - a request has no way to "inherit" a pre-existing, possibly-someone-else's session without a client- presented id. So with no such id here, any session subject.login() below happens to encounter (e.g. one some unrelated filter earlier in the pipeline created for its own reasons) is necessarily a brand new, request-scoped one - not a security concern, even if it's a sign of an unrelated filter doing something surprising with sessions on this path. Use in a try-with-resources around the protected work. Built as a WebSubject (not a bare Subject) so it carries the current request/response pair - required for WebUtils.isHttp(java.lang.Object) to recognize it as an HTTP-bound subject; otherwise BindingSet SubjectFilter evaluation treats it as a non-interactive backend caller and requires an explicit backendCanBypassSubjectFilter opt-out instead of applying the user's own filters.

  • Constructor Details

    • RequestSession

      public RequestSession(RequestAuthenticationToken token, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response) throws org.apache.shiro.authc.AuthenticationException
      Throws:
      org.apache.shiro.authc.AuthenticationException

  • Method Details