Session Management | Apache Shiro - 0 views
shiro.apache.org/session-management.html
java security authentication authorization ApacheShiro SessionManagement session
shared by kuni katsuya on 04 Oct 12
- No Cached
-
available in any application,
-
regardless of container.
-
even if you deploy your application in a Servlet or EJB container, there are still compelling reasons to use Shiro's Session support instead of the container's
- ...40 more annotations...
-
Easy Custom Session Storage
-
POJO/J2SE based (IoC friendly)
-
Container-Independent Clustering!
-
Heterogeneous Client Access
-
Event Listeners
-
listen to lifecycle events during a session's lifetime
-
Host Address Retention
-
retain the IP address or host name of the host from where the session was initiated
-
Inactivity/Expiration Support
-
can be prolonged via a touch() method to keep them 'alive' if desired
-
Transparent Web Use
-
can use Shiro sessions in existing web applications and you
-
don't need to change any of your existing web cod
-
Can be used for SSO
-
easily stored in any data source
-
can be
-
'shared'
-
across applications if needed
-
'poor man's SSO'
-
simple sign-on experience since the shared session can retain authentication state
-
interface-based and implemented with POJOs
-
allows you to easily configure all session components with any JavaBeans-compatible configuration format, like JSON, YAML
-
easily extend
-
customize session management functionality
-
session data can be easily stored in any number of data sources
-
easily clustered using any of the readily-available networked caching products
-
no matter what container you deploy to, your sessions will be clustered the same way
-
No need for container-specific configuration!
-
Shiro sessions can be 'shared' across various client technologies
-
listen for these events and react to them for custom application behavior
-
SecurityUtils.getSubject()
-
currentUser.getSession()
-
If the Subject already has a Session, the boolean argument is ignored and the Session is returned immediately
-
If the Subject does not yet have a Session and the create boolean argument is true,
-
a new session will be created
-
and returned.
-
If the Subject does not yet have a Session and the create boolean argument is false, a new session will not be created and null is returned.
-
Suject.getSession(boolean create)
-
method functions the same way as the
-
HttpServletRequest.getSession(boolean create) method:
-