Package com.predic8.membrane.core.interceptor.session

Class SessionManager

java.lang.Object
com.predic8.membrane.core.interceptor.session.SessionManager
Direct Known Subclasses:
InMemorySessionManager, JwtSessionManager, MemcachedSessionManager, RedisSessionManager
public abstract class SessionManager extends Object

  • Field Details

    • SESSION_VALUE_SEPARATOR

      public static final String SESSION_VALUE_SEPARATOR
      See Also:

    • VALUE_TO_EXPIRE_SESSION_IN_BROWSER

      public static final String VALUE_TO_EXPIRE_SESSION_IN_BROWSER
      See Also:

    • SESSION

      public static final String SESSION
      See Also:

    • usernameKeyName

      protected String usernameKeyName

    • ttlExpiryRefreshOnAccess

      protected boolean ttlExpiryRefreshOnAccess

    • secure

      protected boolean secure

    • sessionCookie

      protected boolean sessionCookie

  • Constructor Details

    • SessionManager

      public SessionManager()

  • Method Details

    • init

      public abstract void init(Router router) throws Exception
      Throws:
      Exception

    • cookieValueToAttributes

      protected abstract Map<String,Object> cookieValueToAttributes(String cookie)
      Transforms a cookie value into its attributes. The cookie should be assumed valid as @isValidCookieForThisSessionManager was called beforehand

    • getCookieValues

      protected abstract Map<Session,String> getCookieValues(Session... session)
      Get the String identifier of the sessions to be used as cookie value.

    • getInvalidCookies

      public abstract List<String> getInvalidCookies(Exchange exc, String validCookie)
      Get all cookies String representations from the request that are not valid anymore, e.g. because the cookie is a self contained value and has changed or expired (e.g. jwt). Should return cookie values in the form of key=value.
      Parameters:
      validCookie - is the cookie value representation of the currently active session. Is key=value

    • getCookieHeaderFields

      public static List<HeaderField> getCookieHeaderFields(Exchange exc)

    • isValidCookieForThisSessionManager

      protected abstract boolean isValidCookieForThisSessionManager(String cookie)
      Gets called for every cookie value. Returns if the cookie value is valid and managed by this manager instance, e.g. jwt session manager checks if the cookie is a jwt, if it has the correct issuer, if it is not expired and if the signature is valid. Cookie is in format key=value

    • cookieRenewalNeeded

      protected abstract boolean cookieRenewalNeeded(String originalCookie)
      Gets called when session was not modified. Should check, if session needs to be renewed (e.g. jwt expiration).
      Parameters:
      originalCookie - the original cookie from which the session was created (can be different from current session)
      Returns:

    • postProcess

      public void postProcess(Exchange exc)

    • getSessionInternal

      protected Session getSessionInternal(Exchange exc)

    • getSession

      @NotNull public @NotNull Session getSession(Exchange exc)

    • createCookieAttributes

      public List<String> createCookieAttributes(Exchange exc)

    • createInvalidationAttributes

      public List<String> createInvalidationAttributes(Exchange exc)

    • getCookies

      protected Stream<String> getCookies(Exchange exc)

    • removeSession

      public void removeSession(Exchange exc)

    • getExpiresAfterSeconds

      public long getExpiresAfterSeconds()

    • setExpiresAfterSeconds

      public void setExpiresAfterSeconds(long expiresAfterSeconds)

    • getDomain

      public String getDomain()

    • setDomain

      public void setDomain(String domain)

    • getCookieHeader

      protected String getCookieHeader(Exchange exc)

    • isHttpOnly

      public boolean isHttpOnly()

    • setHttpOnly

      public void setHttpOnly(boolean httpOnly)

    • getSameSite

      public String getSameSite()

    • setSameSite

      public void setSameSite(String sameSite)

    • getAllCookieKeys

      protected String[] getAllCookieKeys(Exchange exc)

    • getIssuer

      public String getIssuer()

    • setIssuer

      public void setIssuer(String issuer)

    • isTtlExpiryRefreshOnAccess

      public boolean isTtlExpiryRefreshOnAccess()

    • setTtlExpiryRefreshOnAccess

      public void setTtlExpiryRefreshOnAccess(boolean ttlExpiryRefreshOnAccess)
      Default
      true
      Description
      controls if the expiry refreshes to expiresAfterSeconds on access (true) or if it should not refresh (false)

    • isSecure

      public boolean isSecure()

    • setSecure

      public SessionManager setSecure(boolean secure)
      Default
      false
      Description
      forces secure cookie attribute even when no ssl context is present (e.g. TLS termination in front of membrane)

    • isSessionCookie

      public boolean isSessionCookie()

    • setSessionCookie

      public SessionManager setSessionCookie(boolean sessionCookie)
      Default
      false
      Description
      if true removes the expire part of a set cookie header and thus makes it a session cookie