Class ConcurrentSessionFilter
- java.lang.Object
-
- org.springframework.web.filter.GenericFilterBean
-
- org.springframework.security.web.session.ConcurrentSessionFilter
-
- All Implemented Interfaces:
javax.servlet.Filter
,org.springframework.beans.factory.Aware
,org.springframework.beans.factory.BeanNameAware
,org.springframework.beans.factory.DisposableBean
,org.springframework.beans.factory.InitializingBean
,org.springframework.context.EnvironmentAware
,org.springframework.core.env.EnvironmentCapable
,org.springframework.web.context.ServletContextAware
public class ConcurrentSessionFilter extends org.springframework.web.filter.GenericFilterBean
Filter required by concurrent session handling package.This filter performs two functions. First, it calls
SessionRegistry.refreshLastRequest(String)
for each request so that registered sessions always have a correct "last update" date/time. Second, it retrieves aSessionInformation
from theSessionRegistry
for each request and checks if the session has been marked as expired. If it has been marked as expired, the configured logout handlers will be called (as happens withLogoutFilter
), typically to invalidate the session. To handle the expired session a call to theSessionInformationExpiredStrategy
is made. The session invalidation will cause anHttpSessionDestroyedEvent
to be published via theHttpSessionEventPublisher
registered inweb.xml
.
-
-
Constructor Summary
Constructors Constructor Description ConcurrentSessionFilter(org.springframework.security.core.session.SessionRegistry sessionRegistry)
ConcurrentSessionFilter(org.springframework.security.core.session.SessionRegistry sessionRegistry, java.lang.String expiredUrl)
Deprecated.ConcurrentSessionFilter(org.springframework.security.core.session.SessionRegistry sessionRegistry, SessionInformationExpiredStrategy sessionInformationExpiredStrategy)
-
Method Summary
All Methods Instance Methods Concrete Methods Deprecated Methods Modifier and Type Method Description void
afterPropertiesSet()
protected java.lang.String
determineExpiredUrl(javax.servlet.http.HttpServletRequest request, org.springframework.security.core.session.SessionInformation info)
Deprecated.void
doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)
void
setLogoutHandlers(java.util.List<LogoutHandler> handlers)
Set list ofLogoutHandler
void
setLogoutHandlers(LogoutHandler[] handlers)
void
setRedirectStrategy(RedirectStrategy redirectStrategy)
Deprecated.
-
-
-
Constructor Detail
-
ConcurrentSessionFilter
public ConcurrentSessionFilter(org.springframework.security.core.session.SessionRegistry sessionRegistry)
-
ConcurrentSessionFilter
@Deprecated public ConcurrentSessionFilter(org.springframework.security.core.session.SessionRegistry sessionRegistry, java.lang.String expiredUrl)
Deprecated.Creates a new instance- Parameters:
sessionRegistry
- the SessionRegistry to useexpiredUrl
- the URL to redirect to
-
ConcurrentSessionFilter
public ConcurrentSessionFilter(org.springframework.security.core.session.SessionRegistry sessionRegistry, SessionInformationExpiredStrategy sessionInformationExpiredStrategy)
-
-
Method Detail
-
afterPropertiesSet
public void afterPropertiesSet()
- Specified by:
afterPropertiesSet
in interfaceorg.springframework.beans.factory.InitializingBean
- Overrides:
afterPropertiesSet
in classorg.springframework.web.filter.GenericFilterBean
-
doFilter
public void doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain) throws java.io.IOException, javax.servlet.ServletException
- Throws:
java.io.IOException
javax.servlet.ServletException
-
determineExpiredUrl
@Deprecated protected java.lang.String determineExpiredUrl(javax.servlet.http.HttpServletRequest request, org.springframework.security.core.session.SessionInformation info)
Deprecated.Determine the URL for expiration- Parameters:
request
- the HttpServletRequestinfo
- theSessionInformation
- Returns:
- the URL for expiration
-
setLogoutHandlers
public void setLogoutHandlers(LogoutHandler[] handlers)
-
setLogoutHandlers
public void setLogoutHandlers(java.util.List<LogoutHandler> handlers)
Set list ofLogoutHandler
- Parameters:
handlers
- list ofLogoutHandler
- Since:
- 5.2.0
-
setRedirectStrategy
@Deprecated public void setRedirectStrategy(RedirectStrategy redirectStrategy)
Deprecated.Sets theRedirectStrategy
used withConcurrentSessionFilter(SessionRegistry, String)
- Parameters:
redirectStrategy
- theRedirectStrategy
to use
-
-