afs commented on issue #4033: URL: https://github.com/apache/jena/issues/4033#issuecomment-4874244387
> Our backend sends the basic auth header on each request I've recreated that and can see the same thing happening. I have found two ways to remove the need for sessions - both mean that there does not need to a Jetty/jakarta session management at all. My testing setup is Fuseki "plain", the core Fuseki engine, with FMod_Shiro, ping and prometheus; no UI. The UI checks server liveness every few seconds which makes breakpoints in shiro code "interesting". (There are internally four packagings of Fuseki - only "full/UI" is properly exposed. "plain" is running Fuseki as a headless triple store. Longer term work-in-progress in the code - see `FusekiRunner` , entry point `FusekiServerPlainCmd`). This works and should work in 6.1.0: ``` [main] securityManager.subjectDAO.sessionStorageEvaluator.sessionStorageEnabled = false ``` (in 6.1.0 a Jetty `SessionManager` is unnecessarily created once in setup but never used by Shiro or Fuseki) The downside isee in this approach is that it goes in the `shiro.ini` file. To many users, it looks like [gobbledygook](https://en.wikipedia.org/wiki/Gibberish). Fuseki does not use much of `shiro-web` - servlet filter interception, authentication and URL pattern filtering. Using Shiro gives the potential to fit in schemes other than hardwired basic and digest. Shiro session creation can be disabled per-request in the [Fuseki subclass of `ShiroFilter`](https://github.com/apache/jena/blob/main/jena-fuseki2/jena-fuseki-main/src/main/java/org/apache/jena/fuseki/mod/shiro/FMod_Shiro.java#L167): ```java protected ServletRequest prepareServletRequest(ServletRequest request, ServletResponse response, FilterChain chain) { request.setAttribute(DefaultSubjectContext.SESSION_CREATION_ENABLED, Boolean.FALSE); return super.prepareServletRequest(request, response, chain); } ``` I haven't managed to find a way to configure the Shiro environment during server initialization to do that or apply the `subjectDAO` approach in java code. Fuseki is using Shiro2. There is a Shiro-3 in the pipeline. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
