hunt.shiro.mgt.DefaultSessionStorageEvaluator source code

1 /*
2  * Licensed to the Apache Software Foundation (ASF) under one
3  * or more contributor license agreements.  See the NOTICE file
4  * distributed with this work for additional information
5  * regarding copyright ownership.  The ASF licenses this file
6  * to you under the Apache License, Version 2.0 (the
7  * "License"); you may not use this file except in compliance
8  * with the License.  You may obtain a copy of the License at
9  *
10  *     http://www.apache.org/licenses/LICENSE-2.0
11  *
12  * Unless required by applicable law or agreed to in writing,
13  * software distributed under the License is distributed on an
14  * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15  * KIND, either express or implied.  See the License for the
16  * specific language governing permissions and limitations
17  * under the License.
18  */
19 module hunt.shiro.mgt.DefaultSessionStorageEvaluator;
20 
21 import hunt.shiro.mgt.SessionStorageEvaluator;
22 
23 import hunt.shiro.subject.Subject;
24 
25 /**
26  * A Default {@code SessionStorageEvaluator} that provides reasonable control over if and how Sessions may be used for
27  * storing Subject state.  See the {@link #isSessionStorageEnabled(hunt.shiro.subject.Subject)}
28  * method for exact behavior.
29  *
30  */
31 class DefaultSessionStorageEvaluator : SessionStorageEvaluator {
32 
33     /**
34      * Global policy determining if Subject sessions may be used to persist Subject state if the Subject's Session
35      * does not yet exist.
36      */
37     private bool sessionStorageEnabled = true;
38 
39     /**
40      * This implementation functions as follows:
41      * <ul>
42      * <li>If the specified Subject already has an existing {@code Session} (typically because an application developer
43      * has called {@code subject.getSession()} already), Shiro will use that existing session to store subject state.</li>
44      * <li>If a Subject does not yet have a Session, this implementation checks the
45      * {@link #isSessionStorageEnabled() sessionStorageEnabled} property:
46      * <ul>
47      * <li>If {@code sessionStorageEnabled} is true (the default setting), a new session may be created to persist
48      * Subject state if necessary.</li>
49      * <li>If {@code sessionStorageEnabled} is {@code false}, a new session will <em>not</em> be created to persist
50      * session state.</li>
51      * </ul></li>
52      * </ul>
53      * Most applications use Sessions and are OK with the default {@code true} setting for {@code sessionStorageEnabled}.
54      * <p/>
55      * However, if your application is a purely 100% stateless application that never uses sessions,
56      * you will want to set {@code sessionStorageEnabled} to {@code false}.  Realize that a {@code false} value will
57      * ensure that any subject login only retains the authenticated identity for the duration of a request.  Any other
58      * requests, invocations or messages will not be authenticated.
59      *
60      * @param subject the {@code Subject} for which session state persistence may be enabled
61      * @return the value of {@link #isSessionStorageEnabled()} and ignores the {@code Subject} argument.
62      */
63      bool isSessionStorageEnabled(Subject subject) {
64         return (subject !is null && subject.getSession(false) !is null) || isSessionStorageEnabled();
65     }
66 
67     /**
68      * Returns {@code true} if any Subject's {@code Session} may be used to persist that {@code Subject}'s state,
69      * {@code false} otherwise.  The default value is {@code true}.
70      * <p/>
71      * <b>N.B.</b> This is a global configuration setting; setting this value to {@code false} will disable sessions
72      * to persist Subject state for all Subjects that do not already have a Session.  It should typically only be set
73      * to {@code false} for 100% stateless applications (e.g. when sessions aren't used or when remote clients
74      * authenticate on every request).
75      *
76      * @return {@code true} if any Subject's {@code Session} may be used to persist that {@code Subject}'s state,
77      *         {@code false} otherwise.
78      */
79      bool isSessionStorageEnabled() {
80         return sessionStorageEnabled;
81     }
82 
83     /**
84      * Sets if any Subject's {@code Session} may be used to persist that {@code Subject}'s state.  The
85      * default value is {@code true}.
86      * <p/>
87      * <b>N.B.</b> This is a global configuration setting; setting this value to {@code false} will disable sessions
88      * to persist Subject state for all Subjects that do not already have a Session.  It should typically only be set
89      * to {@code false} for 100% stateless applications (e.g. when sessions aren't used or when remote clients
90      * authenticate on every request).
91      *
92      * @param sessionStorageEnabled if any Subject's {@code Session} may be used to persist that {@code Subject}'s state.
93      */
94      void setSessionStorageEnabled(bool sessionStorageEnabled) {
95         this.sessionStorageEnabled = sessionStorageEnabled;
96     }
97 }