Examples with HttpSession javax.servlet.http.HttpSession used on opensource projects

Example 71 with HttpSession

use of javax.servlet.http.HttpSession in project jodd by oblac.

the class AuthTag method doTag.

@Override
public void doTag() throws JspException {
    PageContext pageContext = ((PageContext) getJspContext());
    HttpServletRequest request = (HttpServletRequest) pageContext.getRequest();
    HttpSession httpSession = request.getSession();
    Object userSession = AuthUtil.getUserSession(httpSession);
    boolean invokeBody = (userSession != null) ? auth : !auth;
    if (invokeBody) {
        TagUtil.invokeBody(getJspBody());
    }
}

Example 72 with HttpSession

use of javax.servlet.http.HttpSession in project jodd by oblac.

the class AuthorizationInterceptor method intercept.

public Object intercept(ActionRequest actionRequest) throws Exception {
    HttpServletRequest servletRequest = actionRequest.getHttpServletRequest();
    HttpServletResponse servletResponse = actionRequest.getHttpServletResponse();
    HttpSession session = servletRequest.getSession();
    Object userSession = AuthUtil.getUserSession(session);
    if (log.isDebugEnabled()) {
        log.debug("authorize user: " + userSession);
    }
    if (!authorize(actionRequest, userSession)) {
        if (log.isInfoEnabled()) {
            log.info("access denied for: " + userSession);
        }
        servletResponse.setStatus(HttpServletResponse.SC_FORBIDDEN);
        if (userSession != null) {
            return resultAccessDenied();
        } else {
            return resultLogin(DispatcherUtil.getUrl(servletRequest));
        }
    }
    if (log.isInfoEnabled()) {
        log.info("access granted for: " + userSession);
    }
    return actionRequest.invoke();
}

Example 73 with HttpSession

use of javax.servlet.http.HttpSession in project jodd by oblac.

the class RemoveSessionFromUrlFilter method doFilter.

/**
	 * Filters requests to remove URL-based session identifiers.
	 */
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest httpRequest = (HttpServletRequest) request;
    HttpServletResponse httpResponse = (HttpServletResponse) response;
    if (isRequestedSessionIdFromURL(httpRequest)) {
        HttpSession session = httpRequest.getSession(false);
        if (session != null) {
            // clear session if session id in URL
            session.invalidate();
        }
    }
    // wrap response to remove URL encoding
    HttpServletResponseWrapper wrappedResponse = new HttpServletResponseWrapper(httpResponse) {

        @Override
        public String encodeRedirectUrl(String url) {
            return url;
        }

        @Override
        public String encodeRedirectURL(String url) {
            return url;
        }

        @Override
        public String encodeUrl(String url) {
            return url;
        }

        @Override
        public String encodeURL(String url) {
            return url;
        }
    };
    chain.doFilter(request, wrappedResponse);
}

Example 74 with HttpSession

use of javax.servlet.http.HttpSession in project jodd by oblac.

the class RemoveSessionFromUrlFilter method isRequestedSessionIdFromURL.

/**
	 * Detects if session ID exist in the URL. It works more reliable
	 * than <code>servletRequest.isRequestedSessionIdFromURL()</code>.
	 */
protected boolean isRequestedSessionIdFromURL(HttpServletRequest servletRequest) {
    if (servletRequest.isRequestedSessionIdFromURL()) {
        return true;
    }
    HttpSession session = servletRequest.getSession(false);
    if (session != null) {
        String sessionId = session.getId();
        StringBuffer requestUri = servletRequest.getRequestURL();
        return requestUri.indexOf(sessionId) != -1;
    }
    return false;
}

Example 75 with HttpSession

use of javax.servlet.http.HttpSession in project jodd by oblac.

the class CsrfTokenTag method doTag.

@Override
public void doTag() throws IOException {
    JspContext jspContext = this.getJspContext();
    // generate token
    HttpServletRequest request = (HttpServletRequest) ((PageContext) jspContext).getRequest();
    HttpSession session = request.getSession();
    String value = CsrfShield.prepareCsrfToken(session);
    if (name == null) {
        name = CsrfShield.CSRF_TOKEN_NAME;
    }
    jspContext.getOut().write("<input type=\"hidden\" name=\"" + name + "\" value=\"" + value + "\"/>");
}