Hello All, I decided to upgrade from Shiro 1.2.2 and 1.3.0. I'm now seeing a problem where I can't provide a custom SessionValidatorScheduler. From my Shiro.ini file:
As you can see, I've simplified things as much as possible for this test case. I'm trying to test some expiration problems I've been seeing, so I set the Global Session Timeout to one minute (works) and I'm trying to set the SessionValidationScheduler to one minute as well (so I don't have to wait long for it to clean things out). The problem I'm seeing with the setup above is that my SessionValidationScheduler thread is never started. I'm thinking this stems from a code change in Shiro-443. The first time this is called (when a browser requests the first session since restart), AbstractValidatingSessionManager.enableSessionValidationIfNecessary() is called. This method (shown below unchanged by Shiro-443) checks if the scheduler == null (it doesn't, because I set it through the shiro.ini) and checks scheduler.isEnabled() which is false so it calls enableSessionValidation(). AbstractValidatingSessionManager.enableSessionValidation in 1.3.0 it looks like: while before Shiro-443 it looks like: Since I set the scheduler through Shiro.ini, the scheduler is not null and so the new code won't call scheduler.enableSessionValidation() which will actually start the thread. Hence the thread that actually does the work will never start! If I comment out my shiro.ini line: sessionValidationScheduler.sessionManager = $sessionManager Then, the scheduler is null, so the thread does start, but with the default interval. This seems like a bug introduced by Shiro-443, although I may be missing something. Thanks! --Stephen -- View this message in context: http://shiro-user.582556.n2.nabble.com/Shiro-443-prevents-custom-Session-Validation-Scheduler-tp7581185.html Sent from the Shiro User mailing list archive at Nabble.com.
