Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fixed KapuaSession management on REST API
Signed-off-by: coduz <alberto.codutti@eurotech.com>
- Loading branch information
Showing
6 changed files
with
223 additions
and
122 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
80 changes: 80 additions & 0 deletions
80
...i/core/src/main/java/org/eclipse/kapua/app/api/core/filter/KapuaSessionCleanupFilter.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| /******************************************************************************* | ||
| * Copyright (c) 2019 Eurotech and/or its affiliates and others | ||
| * | ||
| * All rights reserved. This program and the accompanying materials | ||
| * are made available under the terms of the Eclipse Public License v1.0 | ||
| * which accompanies this distribution, and is available at | ||
| * http://www.eclipse.org/legal/epl-v10.html | ||
| * | ||
| * Contributors: | ||
| * Eurotech - initial API and implementation | ||
| *******************************************************************************/ | ||
| package org.eclipse.kapua.app.api.core.filter; | ||
|
|
||
| import org.apache.shiro.SecurityUtils; | ||
| import org.apache.shiro.subject.Subject; | ||
| import org.eclipse.kapua.commons.security.KapuaSecurityUtils; | ||
|
|
||
| import javax.servlet.Filter; | ||
| import javax.servlet.FilterChain; | ||
| import javax.servlet.FilterConfig; | ||
| import javax.servlet.ServletException; | ||
| import javax.servlet.ServletRequest; | ||
| import javax.servlet.ServletResponse; | ||
| import java.io.IOException; | ||
|
|
||
|
|
||
| /** | ||
| * This {@link Filter} cleans up the {@link Subject#getSession()} state and the {@link KapuaSecurityUtils#getSession()} after a request. | ||
| * <p> | ||
| * The processing of the request can leave some information on the Shiro {@link Subject} or the {@link org.eclipse.kapua.commons.security.KapuaSession} and we must clean it to avoid that | ||
| * a subsequent request uses a {@link Thread} with dirty data inside. | ||
| * <p> | ||
| * Apache Shiro it is possible to define {@code noSessionCreation} on the urls mappings in the shiro.ini. | ||
| * Unfortunately using the {@code noSessionCreation} does not have any effect because our {@link org.eclipse.kapua.app.api.core.auth.KapuaTokenAuthenticationFilter} is invoked before the {@link org.apache.shiro.web.filter.session.NoSessionCreationFilter} | ||
| * so it has no effect (see {@link org.apache.shiro.web.filter.session.NoSessionCreationFilter javadoc}. | ||
| * | ||
| * @since 1.1.0 | ||
| */ | ||
| public class KapuaSessionCleanupFilter implements Filter { | ||
|
|
||
| @Override | ||
| public void init(FilterConfig filterConfig) throws ServletException { | ||
| // No init required | ||
| } | ||
|
|
||
| @Override | ||
| public void destroy() { | ||
| // No destroy required | ||
| } | ||
|
|
||
| /** | ||
| * After the invokation of {@link FilterChain#doFilter(ServletRequest, ServletResponse)} the {@link Subject} and the {@link org.eclipse.kapua.commons.security.KapuaSession} | ||
| * are checked and cleaned accordingly. | ||
| * <p> | ||
| * See also {@link Filter#doFilter(ServletRequest, ServletResponse, FilterChain)} javadoc. | ||
| * | ||
| * @param request See {@link Filter#doFilter(ServletRequest, ServletResponse, FilterChain)} javadoc. | ||
| * @param response See {@link Filter#doFilter(ServletRequest, ServletResponse, FilterChain)} javadoc. | ||
| * @param chain See {@link Filter#doFilter(ServletRequest, ServletResponse, FilterChain)} javadoc. | ||
| * @throws IOException See {@link Filter#doFilter(ServletRequest, ServletResponse, FilterChain)} javadoc. | ||
| * @throws ServletException See {@link Filter#doFilter(ServletRequest, ServletResponse, FilterChain)} javadoc. | ||
| * @since 1.1.0 | ||
| */ | ||
| @Override | ||
| public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { | ||
|
|
||
| try { | ||
| chain.doFilter(request, response); | ||
| } finally { | ||
| Subject subject = SecurityUtils.getSubject(); | ||
| if (subject.isAuthenticated()) { | ||
| subject.logout(); | ||
| } | ||
|
|
||
| if (KapuaSecurityUtils.getSession() != null) { | ||
| KapuaSecurityUtils.clearSession(); | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.