Sets the originating host name or IP address (as a string) from where the {@code Subject} is initiating the
{@code Session}.
<p/>
In web-based systems, this host can be inferred from the incoming request, e.g.
{@code javax.servlet.ServletRequest#getRemoteAddr()} or {@code javax.servlet.ServletRequest#getRemoteHost()}
methods, or in socket-based systems, it can be obtained via inspecting the socket
initiator's host IP.
<p/>
Most secure environments <em>should</em> specify a valid, non-{@code null} {@code host}, since knowing the
{@code host} allows for more flexibility when securing a system: by requiring an host, access control policies
can also ensure access is restricted to specific client <em>locations</em> in addition to {@code Subject}
principals, if so desired.
<p/>
<b>Caveat</b> - if clients to your system are on a
public network (as would be the case for a public web site), odds are high the clients can be
behind a NAT (Network Address Translation) router or HTTP proxy server. If so, all clients
accessing your system behind that router or proxy will have the same originating host.
If your system is configured to allow only one session per host, then the next request from a
different NAT or proxy client will fail and access will be denied for that client. Just be
aware that host-based security policies are best utilized in LAN or private WAN environments
when you can be ensure clients will not share IPs or be behind such NAT routers or
proxy servers.
@param host the originating host name or IP address (as a string) from where the {@code Subject} is
initiating the {@code Session}.
Sets the originating host name or IP address (as a string) from where the {@code Subject} is initiating the {@code Session}. <p/> In web-based systems, this host can be inferred from the incoming request, e.g. {@code javax.servlet.ServletRequest#getRemoteAddr()} or {@code javax.servlet.ServletRequest#getRemoteHost()} methods, or in socket-based systems, it can be obtained via inspecting the socket initiator's host IP. <p/> Most secure environments <em>should</em> specify a valid, non-{@code null} {@code host}, since knowing the {@code host} allows for more flexibility when securing a system: by requiring an host, access control policies can also ensure access is restricted to specific client <em>locations</em> in addition to {@code Subject} principals, if so desired. <p/> <b>Caveat</b> - if clients to your system are on a public network (as would be the case for a public web site), odds are high the clients can be behind a NAT (Network Address Translation) router or HTTP proxy server. If so, all clients accessing your system behind that router or proxy will have the same originating host. If your system is configured to allow only one session per host, then the next request from a different NAT or proxy client will fail and access will be denied for that client. Just be aware that host-based security policies are best utilized in LAN or private WAN environments when you can be ensure clients will not share IPs or be behind such NAT routers or proxy servers.
@param host the originating host name or IP address (as a string) from where the {@code Subject} is initiating the {@code Session}.