|
|||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Objectorg.springframework.security.web.authentication.session.SessionFixationProtectionStrategy
org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy
public class ConcurrentSessionControlStrategy
Strategy which handles concurrent session-control, in addition to the functionality provided by the base class.
When invoked following an authentication, it will check whether the user in question should be allowed to proceed,
by comparing the number of sessions they already have active with the configured maximumSessions value.
The SessionRegistry
is used as the source of data on authenticated users and session data.
If a user has reached the maximum number of permitted sessions, the behaviour depends on the
exceptionIfMaxExceeded property. The default behaviour is to expired the least recently used session, which
will be invalidated by the ConcurrentSessionFilter
if accessed again. If exceptionIfMaxExceeded is
set to true, however, the user will be prevented from starting a new authenticated session.
This strategy can be injected into both the SessionManagementFilter
and instances of
AbstractAuthenticationProcessingFilter
(typically UsernamePasswordAuthenticationFilter
).
Field Summary | |
---|---|
protected org.springframework.context.support.MessageSourceAccessor |
messages
|
Fields inherited from class org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy |
---|
logger |
Constructor Summary | |
---|---|
ConcurrentSessionControlStrategy(SessionRegistry sessionRegistry)
|
Method Summary | |
---|---|
protected void |
allowableSessionsExceeded(java.util.List<SessionInformation> sessions,
int allowableSessions,
SessionRegistry registry)
Allows subclasses to customise behaviour when too many sessions are detected. |
protected int |
getMaximumSessionsForThisUser(Authentication authentication)
Method intended for use by subclasses to override the maximum number of sessions that are permitted for a particular authentication. |
void |
onAuthentication(Authentication authentication,
javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response)
Called when a user is newly authenticated. |
protected void |
onSessionChange(java.lang.String originalSessionId,
javax.servlet.http.HttpSession newSession,
Authentication auth)
Called when the session has been changed and the old attributes have been migrated to the new session. |
void |
setAlwaysCreateSession(boolean alwaysCreateSession)
|
void |
setExceptionIfMaximumExceeded(boolean exceptionIfMaximumExceeded)
Sets the exceptionIfMaximumExceeded property, which determines whether the user should be prevented from opening more sessions than allowed. |
void |
setMaximumSessions(int maximumSessions)
Sets the maxSessions property. |
void |
setMessageSource(org.springframework.context.MessageSource messageSource)
|
Methods inherited from class org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy |
---|
setMigrateSessionAttributes, setRetainedAttributes |
Methods inherited from class java.lang.Object |
---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
Field Detail |
---|
protected org.springframework.context.support.MessageSourceAccessor messages
Constructor Detail |
---|
public ConcurrentSessionControlStrategy(SessionRegistry sessionRegistry)
sessionRegistry
- the session registry which should be updated when the authenticated session is changed.Method Detail |
---|
public void onAuthentication(Authentication authentication, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
SessionFixationProtectionStrategy
If a session already exists, and matches the session Id from the client, a new session will be created, and the session attributes copied to it (if migrateSessionAttributes is set). The sessionRegistry will be updated with the new session information. If the client's requested session Id is invalid, nothing will be done, since there is no need to change the session Id if it doesn't match the current session.
If there is no session, no action is taken unless the alwaysCreateSession property is set, in which case a session will be created if one doesn't already exist.
onAuthentication
in interface SessionAuthenticationStrategy
onAuthentication
in class SessionFixationProtectionStrategy
protected int getMaximumSessionsForThisUser(Authentication authentication)
maximumSessions
value
for the bean.
authentication
- to determine the maximum sessions for
protected void allowableSessionsExceeded(java.util.List<SessionInformation> sessions, int allowableSessions, SessionRegistry registry) throws SessionAuthenticationException
sessions
- either null
or all unexpired sessions associated with the principalallowableSessions
- the number of concurrent sessions the user is allowed to haveregistry
- an instance of the SessionRegistry
for subclass use
SessionAuthenticationException
protected void onSessionChange(java.lang.String originalSessionId, javax.servlet.http.HttpSession newSession, Authentication auth)
SessionFixationProtectionStrategy
onSessionChange
in class SessionFixationProtectionStrategy
originalSessionId
- the original session identifiernewSession
- the newly created sessionauth
- the token for the newly authenticated principalpublic void setExceptionIfMaximumExceeded(boolean exceptionIfMaximumExceeded)
exceptionIfMaximumExceeded
- defaults to false.public void setMaximumSessions(int maximumSessions)
maximumSessions
- the maximimum number of permitted sessions a user can have open simultaneously.public void setMessageSource(org.springframework.context.MessageSource messageSource)
setMessageSource
in interface org.springframework.context.MessageSourceAware
public final void setAlwaysCreateSession(boolean alwaysCreateSession)
setAlwaysCreateSession
in class SessionFixationProtectionStrategy
|
|||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |