| java.lang.Object
 org.acegisecurity.context.HttpSessionContextIntegrationFilter
| HttpSessionContextIntegrationFilter | | public class HttpSessionContextIntegrationFilter implements InitializingBean,Filter(Code) | | Populates the
SecurityContextHolder with information obtained from
the HttpSession.
The HttpSession will be queried to retrieve the
SecurityContext that should be stored against the
SecurityContextHolder for the duration of the web request. At
the end of the web request, any updates made to the
SecurityContextHolder will be persisted back to the
HttpSession by this filter.
If a valid SecurityContext cannot be obtained from the
HttpSession for whatever reason, a fresh
SecurityContext will be created and used instead. The created
object will be of the instance defined by the
HttpSessionContextIntegrationFilter.setContext(Class) method (which defaults to
org.acegisecurity.context.SecurityContextImpl .
No HttpSession will be created by this filter if one does not
already exist. If at the end of the web request the HttpSession
does not exist, a HttpSession will only be created if
the current contents of the SecurityContextHolder are not
java.lang.Object.equals(java.lang.Object) to a new
instance of
HttpSessionContextIntegrationFilter.setContext(Class) . This avoids needless
HttpSession creation, but automates the storage of changes
made to the SecurityContextHolder. There is one exception to
this rule, that is if the
HttpSessionContextIntegrationFilter.forceEagerSessionCreation property is
true, in which case sessions will always be created
irrespective of normal session-minimisation logic (the default is
false, as this is resource intensive and not recommended).
This filter will only execute once per request, to resolve servlet container
(specifically Weblogic) incompatibilities.
If for whatever reason no HttpSession should ever be
created (eg this filter is only being used with Basic authentication or
similar clients that will never present the same jsessionid
etc), the
HttpSessionContextIntegrationFilter.setAllowSessionCreation(boolean) should be set to
false. Only do this if you really need to conserve server
memory and ensure all classes using the SecurityContextHolder
are designed to have no persistence of the SecurityContext
between web requests. Please note that if
HttpSessionContextIntegrationFilter.forceEagerSessionCreation is true, the allowSessionCreation must also be
true (setting it to false will cause a startup
time error).
This filter MUST be executed BEFORE any authentication processing mechanisms.
Authentication processing mechanisms (eg BASIC, CAS processing filters etc)
expect the SecurityContextHolder to contain a valid
SecurityContext by the time they execute.
author:
Ben Alex
author:
Patrick Burleson
author:
Luke Taylor
author:
Martin Algesten
version:
$Id: HttpSessionContextIntegrationFilter.java 2004 2007-09-01 14:43:09Z raykrueger $ |
| ACEGI_SECURITY_CONTEXT_KEY | | final public static String ACEGI_SECURITY_CONTEXT_KEY(Code) | | |
| logger | | final protected static Log logger(Code) | | |
| destroy | | public void destroy()(Code) | | Does nothing. We use IoC container lifecycle services instead.
|
| isAllowSessionCreation | | public boolean isAllowSessionCreation()(Code) | | |
| isCloneFromHttpSession | | public boolean isCloneFromHttpSession()(Code) | | |
| isForceEagerSessionCreation | | public boolean isForceEagerSessionCreation()(Code) | | |
| setAllowSessionCreation | | public void setAllowSessionCreation(boolean allowSessionCreation)(Code) | | |
| setCloneFromHttpSession | | public void setCloneFromHttpSession(boolean cloneFromHttpSession)(Code) | | |
| setContext | | public void setContext(Class secureContext)(Code) | | |
| setForceEagerSessionCreation | | public void setForceEagerSessionCreation(boolean forceEagerSessionCreation)(Code) | | |
|
|