Package org.apache.shiro.session.mgt
Class DefaultSessionContext
- java.lang.Object
-
- org.apache.shiro.util.MapContext
-
- org.apache.shiro.session.mgt.DefaultSessionContext
-
- All Implemented Interfaces:
Serializable
,Map<String,Object>
,SessionContext
public class DefaultSessionContext extends MapContext implements SessionContext
Default implementation of theSessionContext
interface which provides getters and setters that wrap interaction with the underlying backing context map.- Since:
- 1.0
- See Also:
- Serialized Form
-
-
Constructor Summary
Constructors Constructor Description DefaultSessionContext()
DefaultSessionContext(Map<String,Object> map)
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description String
getHost()
Returns the originating host name or IP address (as a String) from where theSubject
is initiating theSession
.Serializable
getSessionId()
void
setHost(String host)
Sets the originating host name or IP address (as a String) from where theSubject
is initiating theSession
.void
setSessionId(Serializable sessionId)
-
Methods inherited from class org.apache.shiro.util.MapContext
clear, containsKey, containsValue, entrySet, get, getTypedValue, isEmpty, keySet, nullSafePut, put, putAll, remove, size, values
-
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
-
Methods inherited from interface java.util.Map
clear, compute, computeIfAbsent, computeIfPresent, containsKey, containsValue, entrySet, equals, forEach, get, getOrDefault, hashCode, isEmpty, keySet, merge, put, putAll, putIfAbsent, remove, remove, replace, replace, replaceAll, size, values
-
-
-
-
Constructor Detail
-
DefaultSessionContext
public DefaultSessionContext()
-
DefaultSessionContext
public DefaultSessionContext(Map<String,Object> map)
-
-
Method Detail
-
getHost
public String getHost()
Description copied from interface:SessionContext
Returns the originating host name or IP address (as a String) from where theSubject
is initiating theSession
. See thesetHost(String)
JavaDoc for more about security policies based on theSession
host.- Specified by:
getHost
in interfaceSessionContext
- Returns:
- the originating host name or IP address (as a String) from where the
Subject
is initiating theSession
. - See Also:
setHost(String)
-
setHost
public void setHost(String host)
Description copied from interface:SessionContext
Sets the originating host name or IP address (as a String) from where theSubject
is initiating theSession
. In web-based systems, this host can be inferred from the incoming request, e.g.javax.servlet.ServletRequest#getRemoteAddr()
orjavax.servlet.ServletRequest#getRemoteHost()
methods, or in socket-based systems, it can be obtained via inspecting the socket initiator's host IP. Most secure environments should specify a valid, non-null
host
, since knowing thehost
allows for more flexibility when securing a system: by requiring an host, access control policies can also ensure access is restricted to specific client locations in addition toSubject
principals, if so desired. Caveat - if clients to your system are on a public network (as would be the case for a public web site), odds are high the clients can be behind a NAT (Network Address Translation) router or HTTP proxy server. If so, all clients accessing your system behind that router or proxy will have the same originating host. If your system is configured to allow only one session per host, then the next request from a different NAT or proxy client will fail and access will be denied for that client. Just be aware that host-based security policies are best utilized in LAN or private WAN environments when you can be ensure clients will not share IPs or be behind such NAT routers or proxy servers.- Specified by:
setHost
in interfaceSessionContext
- Parameters:
host
- the originating host name or IP address (as a String) from where theSubject
is initiating theSession
.
-
getSessionId
public Serializable getSessionId()
- Specified by:
getSessionId
in interfaceSessionContext
-
setSessionId
public void setSessionId(Serializable sessionId)
- Specified by:
setSessionId
in interfaceSessionContext
-
-