|
|||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Objectorg.springframework.security.config.annotation.SecurityConfigurerAdapter<DefaultSecurityFilterChain,B>
org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer<H>
public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
Allows configuring session management.
SessionManagementFilter
ConcurrentSessionFilter
if there are restrictions on how many concurrent sessions a user can have
SessionManagementFilter
,
ConcurrentSessionFilter
Nested Class Summary | |
---|---|
class |
SessionManagementConfigurer.ConcurrencyControlConfigurer
Allows configuring controlling of multiple sessions. |
class |
SessionManagementConfigurer.SessionFixationConfigurer
Allows configuring SessionFixation protection |
Constructor Summary | |
---|---|
SessionManagementConfigurer()
Creates a new instance |
Method Summary | |
---|---|
void |
configure(H http)
Configure the SecurityBuilder by setting the necessary properties
on the SecurityBuilder . |
B |
disable()
Disables the AbstractHttpConfigurer by removing it. |
SessionManagementConfigurer<H> |
enableSessionUrlRewriting(boolean enableSessionUrlRewriting)
If set to true, allows HTTP sessions to be rewritten in the URLs when using HttpServletResponse.encodeRedirectURL(String) or
HttpServletResponse.encodeURL(String) , otherwise disallows HTTP
sessions to be included in the URL. |
void |
init(H builder)
Initialize the SecurityBuilder . |
SessionManagementConfigurer<H> |
invalidSessionUrl(String invalidSessionUrl)
Setting this attribute will inject the SessionManagementFilter with a
SimpleRedirectInvalidSessionStrategy configured with the attribute value. |
SessionManagementConfigurer.ConcurrencyControlConfigurer |
maximumSessions(int maximumSessions)
Controls the maximum number of sessions for a user. |
SessionManagementConfigurer<H> |
sessionAuthenticationErrorUrl(String sessionAuthenticationErrorUrl)
Defines the URL of the error page which should be shown when the SessionAuthenticationStrategy raises an exception. |
SessionManagementConfigurer<H> |
sessionAuthenticationStrategy(SessionAuthenticationStrategy sessionAuthenticationStrategy)
Allows explicitly specifying the SessionAuthenticationStrategy . |
SessionManagementConfigurer<H> |
sessionCreationPolicy(SessionCreationPolicy sessionCreationPolicy)
Allows specifying the SessionCreationPolicy |
SessionManagementConfigurer.SessionFixationConfigurer |
sessionFixation()
|
T |
withObjectPostProcessor(ObjectPostProcessor<?> objectPostProcessor)
|
Methods inherited from class org.springframework.security.config.annotation.SecurityConfigurerAdapter |
---|
addObjectPostProcessor, and, getBuilder, postProcess, setBuilder |
Methods inherited from class java.lang.Object |
---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
Constructor Detail |
---|
public SessionManagementConfigurer()
HttpSecurity.sessionManagement()
Method Detail |
---|
public SessionManagementConfigurer<H> invalidSessionUrl(String invalidSessionUrl)
SessionManagementFilter
with a
SimpleRedirectInvalidSessionStrategy
configured with the attribute value.
When an invalid session ID is submitted, the strategy will be invoked,
redirecting to the configured URL.
invalidSessionUrl
- the URL to redirect to when an invalid session is detected
SessionManagementConfigurer
for further customizationpublic SessionManagementConfigurer<H> sessionAuthenticationErrorUrl(String sessionAuthenticationErrorUrl)
sessionAuthenticationErrorUrl
- the URL to redirect to
SessionManagementConfigurer
for further customizationpublic SessionManagementConfigurer<H> enableSessionUrlRewriting(boolean enableSessionUrlRewriting)
HttpServletResponse.encodeRedirectURL(String)
or
HttpServletResponse.encodeURL(String)
, otherwise disallows HTTP
sessions to be included in the URL. This prevents leaking information to
external domains.
enableSessionUrlRewriting
- true if should allow the JSESSIONID to be rewritten into the URLs, else false (default)
SessionManagementConfigurer
for further customizationHttpSessionSecurityContextRepository.setDisableUrlRewriting(boolean)
public SessionManagementConfigurer<H> sessionCreationPolicy(SessionCreationPolicy sessionCreationPolicy)
SessionCreationPolicy
sessionCreationPolicy
- the SessionCreationPolicy
to use. Cannot be null.
SessionManagementConfigurer
for further customizations
IllegalArgumentException
- if SessionCreationPolicy
is null.SessionCreationPolicy
public SessionManagementConfigurer<H> sessionAuthenticationStrategy(SessionAuthenticationStrategy sessionAuthenticationStrategy)
SessionAuthenticationStrategy
.
The default is to use SessionFixationProtectionStrategy
. If
restricting the maximum number of sessions is configured, then
CompositeSessionAuthenticationStrategy
delegating to
ConcurrentSessionControlAuthenticationStrategy
,
SessionFixationProtectionStrategy
(optional), and
RegisterSessionAuthenticationStrategy
will be used.
sessionAuthenticationStrategy
-
SessionManagementConfigurer
for further
customizationspublic SessionManagementConfigurer.SessionFixationConfigurer sessionFixation()
public SessionManagementConfigurer.ConcurrencyControlConfigurer maximumSessions(int maximumSessions)
maximumSessions
- the maximum number of sessions for a user
SessionManagementConfigurer
for further customizationspublic void init(H builder) throws Exception
SecurityConfigurer
SecurityBuilder
. Here only shared state should be
created and modified, but not properties on the SecurityBuilder
used for building the object. This ensures that the
SecurityConfigurer.configure(SecurityBuilder)
method uses the correct shared
objects when building.
init
in interface SecurityConfigurer<DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>
init
in class SecurityConfigurerAdapter<DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>
Exception
public void configure(H http) throws Exception
SecurityConfigurer
SecurityBuilder
by setting the necessary properties
on the SecurityBuilder
.
configure
in interface SecurityConfigurer<DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>
configure
in class SecurityConfigurerAdapter<DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>
Exception
public B disable()
AbstractHttpConfigurer
by removing it. After doing
so a fresh version of the configuration can be applied.
HttpSecurityBuilder
for additional customizationspublic T withObjectPostProcessor(ObjectPostProcessor<?> objectPostProcessor)
|
|||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |