This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro.git
The following commit(s) were added to refs/heads/main by this push:
new 7cb2054b2 Enhancement: support for remembered principals in session
management, check w… (#2859)
7cb2054b2 is described below
commit 7cb2054b200ccd94dfcf7432157afddccb6f666c
Author: Lenny Primak <[email protected]>
AuthorDate: Sun Aug 16 12:45:00 2026 -0500
Enhancement: support for remembered principals in session management, check
w… (#2859)
---
.../java/org/apache/shiro/mgt/DefaultSecurityManager.java | 7 ++++---
.../java/org/apache/shiro/subject/SubjectContext.java | 15 +++++++++++++++
.../shiro/subject/support/DefaultSubjectContext.java | 11 +++++++++++
.../shiro/web/session/mgt/DefaultWebSessionManager.java | 8 +++-----
4 files changed, 33 insertions(+), 8 deletions(-)
diff --git
a/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java
b/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java
index ebf05622f..86155b570 100644
--- a/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java
+++ b/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java
@@ -379,6 +379,9 @@ public class DefaultSecurityManager extends
SessionsSecurityManager {
//session, so we don't constantly rehydrate the rememberMe
PrincipalCollection on every operation).
//Added in 1.2:
if (context.isSessionCreationEnabled()) {
+ if (context.isRememberedPrincipals()) {
+ beforeSuccessfulLogin(subject);
+ }
save(subject);
}
@@ -439,7 +442,6 @@ public class DefaultSecurityManager extends
SessionsSecurityManager {
* @return The SubjectContext to use to pass to a {@link SubjectFactory}
for subject creation.
* @since 1.0
*/
- @SuppressWarnings({"unchecked"})
protected SubjectContext ensureSecurityManager(SubjectContext context) {
if (context.resolveSecurityManager() != null) {
LOGGER.trace("Context already contains a SecurityManager instance.
Returning.");
@@ -463,7 +465,6 @@ public class DefaultSecurityManager extends
SessionsSecurityManager {
* @return The context to use to pass to a {@link SubjectFactory} for
subject creation.
* @since 1.0
*/
- @SuppressWarnings({"unchecked"})
protected SubjectContext resolveSession(SubjectContext context) {
if (context.resolveSession() != null) {
LOGGER.debug("Context already contains a session. Returning.");
@@ -518,7 +519,6 @@ public class DefaultSecurityManager extends
SessionsSecurityManager {
* @return The Subject context to use to pass to a {@link SubjectFactory}
for subject creation.
* @since 1.0
*/
- @SuppressWarnings({"unchecked"})
protected SubjectContext resolvePrincipals(SubjectContext context) {
PrincipalCollection principals = context.resolvePrincipals();
@@ -531,6 +531,7 @@ public class DefaultSecurityManager extends
SessionsSecurityManager {
if (!isEmpty(principals)) {
LOGGER.debug("Found remembered PrincipalCollection. Adding to
the context to be used "
+ "for subject construction by the SubjectFactory.");
+ context.setRememberedPrincipals(true);
context.setPrincipals(principals);
diff --git a/core/src/main/java/org/apache/shiro/subject/SubjectContext.java
b/core/src/main/java/org/apache/shiro/subject/SubjectContext.java
index d9e29a639..a57ec64d1 100644
--- a/core/src/main/java/org/apache/shiro/subject/SubjectContext.java
+++ b/core/src/main/java/org/apache/shiro/subject/SubjectContext.java
@@ -235,4 +235,19 @@ public interface SubjectContext extends Map<String,
Object> {
void setHost(String host);
String resolveHost();
+
+ /**
+ * Sets whether the constructed {@code Subject} instance should was
constructed from remembered principals
+ */
+ default void setRememberedPrincipals(boolean rememberedPrincipals) {
+ throw new IllegalStateException("Remembered principals are not
supported by this SubjectContext implementation.");
+ }
+
+ /**
+ * Returns whether the constructed {@code Subject} instance was
constructed from remembered principals
+ * @return true if the constructed {@code Subject} instance was
constructed from remembered principals, false otherwise
+ */
+ default boolean isRememberedPrincipals() {
+ throw new IllegalStateException("Remembered principals are not
supported by this SubjectContext implementation.");
+ }
}
diff --git
a/core/src/main/java/org/apache/shiro/subject/support/DefaultSubjectContext.java
b/core/src/main/java/org/apache/shiro/subject/support/DefaultSubjectContext.java
index 54cb73e4d..f14612bee 100644
---
a/core/src/main/java/org/apache/shiro/subject/support/DefaultSubjectContext.java
+++
b/core/src/main/java/org/apache/shiro/subject/support/DefaultSubjectContext.java
@@ -79,6 +79,8 @@ public class DefaultSubjectContext extends MapContext
implements SubjectContext
private static final String HOST = DefaultSubjectContext.class.getName() +
".HOST";
+ private static final String REMEMBERED_PRINCIPALS =
DefaultSubjectContext.class.getName() + ".REMEMBERED_PRINCIPALS";
+
private static final Logger LOGGER =
LoggerFactory.getLogger(DefaultSubjectContext.class);
public DefaultSubjectContext() {
@@ -279,4 +281,13 @@ public class DefaultSubjectContext extends MapContext
implements SubjectContext
return host;
}
+
+ public void setRememberedPrincipals(boolean remembered) {
+ put(REMEMBERED_PRINCIPALS, remembered);
+ }
+
+ public boolean isRememberedPrincipals() {
+ Boolean remembered = getTypedValue(REMEMBERED_PRINCIPALS,
Boolean.class);
+ return remembered != null && remembered;
+ }
}
diff --git
a/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java
b/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java
index 2f00b326a..759e41ab5 100644
---
a/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java
+++
b/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java
@@ -114,11 +114,10 @@ public class DefaultWebSessionManager extends
DefaultSessionManager implements W
LOGGER.debug("Session ID cookie is disabled - session id will not
be acquired from a request cookie.");
return null;
}
- if (!(request instanceof HttpServletRequest)) {
+ if (!(request instanceof HttpServletRequest httpRequest)) {
LOGGER.debug("Current request is not an HttpServletRequest -
cannot get session ID cookie. Returning null.");
return null;
}
- HttpServletRequest httpRequest = (HttpServletRequest) request;
return getSessionIdCookie().readValue(httpRequest,
WebUtils.toHttp(response));
}
@@ -128,7 +127,7 @@ public class DefaultWebSessionManager extends
DefaultSessionManager implements W
if (id != null) {
request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE,
ShiroHttpServletRequest.COOKIE_SESSION_ID_SOURCE);
- } else {
+ } else if (isSessionIdUrlRewritingEnabled()) {
//not in a cookie, or cookie is disabled - try the request URI as
a fallback (i.e. due to URL rewriting):
//try the URI path segment parameters first:
@@ -170,10 +169,9 @@ public class DefaultWebSessionManager extends
DefaultSessionManager implements W
//since 1.2.2
private String getUriPathSegmentParamValue(ServletRequest servletRequest,
String paramName) {
- if (!(servletRequest instanceof HttpServletRequest)) {
+ if (!(servletRequest instanceof HttpServletRequest request)) {
return null;
}
- HttpServletRequest request = (HttpServletRequest) servletRequest;
String uri = request.getRequestURI();
if (uri == null) {
return null;
