Package org.apache.shiro.session.mgt

Class AbstractValidatingSessionManager

    • Field Detail

      • sessionValidationSchedulerEnabled

        protected boolean sessionValidationSchedulerEnabled

      • sessionValidationScheduler

        protected SessionValidationScheduler sessionValidationScheduler
        Scheduler used to validate sessions on a regular basis.

      • sessionValidationInterval

        protected long sessionValidationInterval

    • Constructor Detail

      • AbstractValidatingSessionManager

        public AbstractValidatingSessionManager()

    • Method Detail

      • isSessionValidationSchedulerEnabled

        public boolean isSessionValidationSchedulerEnabled()

      • setSessionValidationSchedulerEnabled

        public void setSessionValidationSchedulerEnabled​(boolean sessionValidationSchedulerEnabled)

      • setSessionValidationScheduler

        public void setSessionValidationScheduler​(SessionValidationScheduler sessionValidationScheduler)

      • setSessionValidationInterval

        public void setSessionValidationInterval​(long sessionValidationInterval)
        If using the underlying default SessionValidationScheduler (that is, the setSessionValidationScheduler method is never called) , this method allows one to specify how frequently session should be validated (to check for orphans). The default value is DEFAULT_SESSION_VALIDATION_INTERVAL.

        If you override the default scheduler, it is assumed that overriding instance 'knows' how often to validate sessions, and this attribute will be ignored.

        Unless this method is called, the default value is DEFAULT_SESSION_VALIDATION_INTERVAL.

        Parameters:
        sessionValidationInterval - the time in milliseconds between checking for valid sessions to reap orphans.

      • getSessionValidationInterval

        public long getSessionValidationInterval()

      • retrieveSession

        protected abstract Session retrieveSession​(SessionKey key)
                                    throws UnknownSessionException
        Looks up a session from the underlying data store based on the specified session key.
        Parameters:
        key - the session key to use to look up the target session.
        Returns:
        the session identified by sessionId.
        Throws:
        UnknownSessionException - if there is no session identified by sessionId.

      • onExpiration

        protected void onExpiration​(Session session)

      • afterExpired

        protected void afterExpired​(Session session)

      • getTimeout

        protected long getTimeout​(Session session)
        Subclass template hook in case per-session timeout is not based on Session.getTimeout().

        This implementation merely returns Session.getTimeout()

        Parameters:
        session - the session for which to determine session timeout.
        Returns:
        the time in milliseconds the specified session may remain idle before expiring.

      • enableSessionValidation

        protected void enableSessionValidation()

      • afterSessionValidationEnabled

        protected void afterSessionValidationEnabled()

      • disableSessionValidation

        protected void disableSessionValidation()

      • beforeSessionValidationDisabled

        protected void beforeSessionValidationDisabled()

      • destroy

        public void destroy()
        Specified by:
        destroy in interface org.apache.shiro.util.Destroyable

      • validateSessions

        public void validateSessions()
        Description copied from interface: ValidatingSessionManager
        Performs session validation for all open/active sessions in the system (those that have not been stopped or expired), and validates each one. If a session is found to be invalid (e.g. it has expired), it is updated and saved to the EIS.

        This method is necessary in order to handle orphaned sessions and is expected to be run at a regular interval, such as once an hour, once a day or once a week, etc. The "best" frequency to run this method is entirely dependent upon the application and would be based on factors such as performance, average number of active users, hours of least activity, and other things.

        Most enterprise applications use a request/response programming model. This is obvious in the case of web applications due to the HTTP protocol, but it is equally true of remote client applications making remote method invocations. The server essentially sits idle and only "works" when responding to client requests and/or method invocations. This type of model is particularly efficient since it means the security system only has to validate a session during those cases. Such "lazy" behavior enables the system to lie stateless and/or idle and only incur overhead for session validation when necessary.

        However, if a client forgets to log-out, or in the event of a server failure, it is possible for sessions to be orphaned since no further requests would utilize that session. Because of these lower-probability cases, it might be required to regularly clean-up the sessions maintained by the system, especially if sessions are backed by a persistent data store.

        Even in applications that aren't primarily based on a request/response model, such as those that use enterprise asynchronous messaging (where data is pushed to a client without first receiving a client request), it is almost always acceptable to utilize this lazy approach and run this method at defined interval.

        Systems that want to proactively validate individual sessions may simply call the getSession(SessionKey) method on any ValidatingSessionManager instance as that method is expected to validate the session before retrieving it. Note that even with proactive calls to getSession, this validateSessions() method should be invoked regularly anyway to guarantee no orphans exist.

        Note: Shiro supports automatic execution of this method at a regular interval by using SessionValidationSchedulers. The Shiro default SecurityManager implementations needing session validation will create and use one by default if one is not provided by the application configuration.

        Specified by:
        validateSessions in interface ValidatingSessionManager
        See Also:
        ValidatingSessionManager.validateSessions()

      • getActiveSessions

        protected abstract <Session> getActiveSessions()