Examples with Session org.apache.catalina.Session used on opensource projects

Example 86 with Session

use of org.apache.catalina.Session in project tomcat by apache.

the class FormAuthenticator method doAuthenticate.

// ------------------------------------------------------ Protected Methods
/**
 * Authenticate the user making this request, based on the specified
 * login configuration.  Return <code>true</code> if any specified
 * constraint has been satisfied, or <code>false</code> if we have
 * created a response challenge already.
 *
 * @param request Request we are processing
 * @param response Response we are creating
 *
 * @exception IOException if an input/output error occurs
 */
@Override
protected boolean doAuthenticate(Request request, HttpServletResponse response) throws IOException {
    // References to objects we will need later
    Session session = null;
    Principal principal = null;
    // Have we authenticated this user before but have caching disabled?
    if (!cache) {
        session = request.getSessionInternal(true);
        if (log.isDebugEnabled()) {
            log.debug("Checking for reauthenticate in session " + session);
        }
        String username = (String) session.getNote(Constants.SESS_USERNAME_NOTE);
        String password = (String) session.getNote(Constants.SESS_PASSWORD_NOTE);
        if (username != null && password != null) {
            if (log.isDebugEnabled()) {
                log.debug("Reauthenticating username '" + username + "'");
            }
            principal = context.getRealm().authenticate(username, password);
            if (principal != null) {
                register(request, response, principal, HttpServletRequest.FORM_AUTH, username, password);
                if (!matchRequest(request)) {
                    return true;
                }
            }
            if (log.isDebugEnabled()) {
                log.debug("Reauthentication failed, proceed normally");
            }
        }
    }
    // authentication?  If so, forward the *original* request instead.
    if (matchRequest(request)) {
        session = request.getSessionInternal(true);
        if (log.isDebugEnabled()) {
            log.debug("Restore request from session '" + session.getIdInternal() + "'");
        }
        if (restoreRequest(request, session)) {
            if (log.isDebugEnabled()) {
                log.debug("Proceed to restored request");
            }
            return true;
        } else {
            if (log.isDebugEnabled()) {
                log.debug("Restore of original request failed");
            }
            response.sendError(HttpServletResponse.SC_BAD_REQUEST);
            return false;
        }
    }
    // because that matching request may also include a cached Principal.
    if (checkForCachedAuthentication(request, response, true)) {
        return true;
    }
    // Acquire references to objects we will need to evaluate
    String contextPath = request.getContextPath();
    String requestURI = request.getDecodedRequestURI();
    // Is this the action request from the login page?
    boolean loginAction = requestURI.startsWith(contextPath) && requestURI.endsWith(Constants.FORM_ACTION);
    LoginConfig config = context.getLoginConfig();
    // No -- Save this request and redirect to the form login page
    if (!loginAction) {
        // may not go to the correct web application
        if (request.getServletPath().length() == 0 && request.getPathInfo() == null) {
            StringBuilder location = new StringBuilder(requestURI);
            location.append('/');
            if (request.getQueryString() != null) {
                location.append('?');
                location.append(request.getQueryString());
            }
            response.sendRedirect(response.encodeRedirectURL(location.toString()));
            return false;
        }
        session = request.getSessionInternal(true);
        if (log.isDebugEnabled()) {
            log.debug("Save request in session '" + session.getIdInternal() + "'");
        }
        try {
            saveRequest(request, session);
        } catch (IOException ioe) {
            log.debug("Request body too big to save during authentication");
            response.sendError(HttpServletResponse.SC_FORBIDDEN, sm.getString("authenticator.requestBodyTooBig"));
            return false;
        }
        forwardToLoginPage(request, response, config);
        return false;
    }
    // Yes -- Acknowledge the request, validate the specified credentials
    // and redirect to the error page if they are not correct
    request.getResponse().sendAcknowledgement(ContinueResponseTiming.ALWAYS);
    Realm realm = context.getRealm();
    if (characterEncoding != null) {
        request.setCharacterEncoding(characterEncoding);
    }
    String username = request.getParameter(Constants.FORM_USERNAME);
    String password = request.getParameter(Constants.FORM_PASSWORD);
    if (log.isDebugEnabled()) {
        log.debug("Authenticating username '" + username + "'");
    }
    principal = realm.authenticate(username, password);
    if (principal == null) {
        forwardToErrorPage(request, response, config);
        return false;
    }
    if (log.isDebugEnabled()) {
        log.debug("Authentication of '" + username + "' was successful");
    }
    if (session == null) {
        session = request.getSessionInternal(false);
    }
    if (session != null && getChangeSessionIdOnAuthentication()) {
        // Does session id match?
        String expectedSessionId = (String) session.getNote(Constants.SESSION_ID_NOTE);
        if (expectedSessionId == null || !expectedSessionId.equals(request.getRequestedSessionId())) {
            session.expire();
            session = null;
        }
    }
    if (session == null) {
        if (containerLog.isDebugEnabled()) {
            containerLog.debug("User took so long to log on the session expired");
        }
        if (landingPage == null) {
            response.sendError(HttpServletResponse.SC_REQUEST_TIMEOUT, sm.getString("authenticator.sessionExpired"));
        } else {
            // Make the authenticator think the user originally requested
            // the landing page
            String uri = request.getContextPath() + landingPage;
            SavedRequest saved = new SavedRequest();
            saved.setMethod("GET");
            saved.setRequestURI(uri);
            saved.setDecodedRequestURI(uri);
            request.getSessionInternal(true).setNote(Constants.FORM_REQUEST_NOTE, saved);
            response.sendRedirect(response.encodeRedirectURL(uri));
        }
        return false;
    }
    register(request, response, principal, HttpServletRequest.FORM_AUTH, username, password);
    // Redirect the user to the original request URI (which will cause
    // the original request to be restored)
    requestURI = savedRequestURL(session);
    if (log.isDebugEnabled()) {
        log.debug("Redirecting to original '" + requestURI + "'");
    }
    if (requestURI == null) {
        if (landingPage == null) {
            response.sendError(HttpServletResponse.SC_BAD_REQUEST, sm.getString("authenticator.formlogin"));
        } else {
            // Make the authenticator think the user originally requested
            // the landing page
            String uri = request.getContextPath() + landingPage;
            SavedRequest saved = new SavedRequest();
            saved.setMethod("GET");
            saved.setRequestURI(uri);
            saved.setDecodedRequestURI(uri);
            session.setNote(Constants.FORM_REQUEST_NOTE, saved);
            response.sendRedirect(response.encodeRedirectURL(uri));
        }
    } else {
        // Until the Servlet API allows specifying the type of redirect to
        // use.
        Response internalResponse = request.getResponse();
        String location = response.encodeRedirectURL(requestURI);
        if ("HTTP/1.1".equals(request.getProtocol())) {
            internalResponse.sendRedirect(location, HttpServletResponse.SC_SEE_OTHER);
        } else {
            internalResponse.sendRedirect(location, HttpServletResponse.SC_FOUND);
        }
    }
    return false;
}

Example 87 with Session

use of org.apache.catalina.Session in project tomcat by apache.

the class FormAuthenticator method isContinuationRequired.

@Override
protected boolean isContinuationRequired(Request request) {
    // Special handling for form-based logins to deal with the case
    // where the login form (and therefore the "j_security_check" URI
    // to which it submits) might be outside the secured area
    String contextPath = this.context.getPath();
    String decodedRequestURI = request.getDecodedRequestURI();
    if (decodedRequestURI.startsWith(contextPath) && decodedRequestURI.endsWith(Constants.FORM_ACTION)) {
        return true;
    }
    // Special handling for form-based logins to deal with the case where
    // a resource is protected for some HTTP methods but not protected for
    // GET which is used after authentication when redirecting to the
    // protected resource.
    // TODO: This is similar to the FormAuthenticator.matchRequest() logic
    // Is there a way to remove the duplication?
    Session session = request.getSessionInternal(false);
    if (session != null) {
        SavedRequest savedRequest = (SavedRequest) session.getNote(Constants.FORM_REQUEST_NOTE);
        if (savedRequest != null && decodedRequestURI.equals(savedRequest.getDecodedRequestURI())) {
            return true;
        }
    }
    return false;
}

Example 88 with Session

use of org.apache.catalina.Session in project tomcat by apache.

the class StandardManager method stopInternal.

/**
 * Stop this component and implement the requirements
 * of {@link org.apache.catalina.util.LifecycleBase#stopInternal()}.
 *
 * @exception LifecycleException if this component detects a fatal error
 *  that prevents this component from being used
 */
@Override
protected synchronized void stopInternal() throws LifecycleException {
    if (log.isDebugEnabled()) {
        log.debug("Stopping");
    }
    setState(LifecycleState.STOPPING);
    // Write out sessions
    try {
        unload();
    } catch (Throwable t) {
        ExceptionUtils.handleThrowable(t);
        log.error(sm.getString("standardManager.managerUnload"), t);
    }
    // Expire all active sessions
    Session[] sessions = findSessions();
    for (Session session : sessions) {
        try {
            if (session.isValid()) {
                session.expire();
            }
        } catch (Throwable t) {
            ExceptionUtils.handleThrowable(t);
        } finally {
            // Measure against memory leaking if references to the session
            // object are kept in a shared field somewhere
            session.recycle();
        }
    }
    // Require a new random number generator if we are restarted
    super.stopInternal();
}

Example 89 with Session

use of org.apache.catalina.Session in project tomcat by apache.

the class ManagerBase method getSession.

/**
 * Returns information about the session with the given session id.
 *
 * <p>The session information is organized as a HashMap, mapping
 * session attribute names to the String representation of their values.
 *
 * @param sessionId Session id
 *
 * @return HashMap mapping session attribute names to the String
 * representation of their values, or null if no session with the
 * specified id exists, or if the session does not have any attributes
 */
public HashMap<String, String> getSession(String sessionId) {
    Session s = sessions.get(sessionId);
    if (s == null) {
        if (log.isInfoEnabled()) {
            log.info(sm.getString("managerBase.sessionNotFound", sessionId));
        }
        return null;
    }
    Enumeration<String> ee = s.getSession().getAttributeNames();
    if (ee == null || !ee.hasMoreElements()) {
        return null;
    }
    HashMap<String, String> map = new HashMap<>();
    while (ee.hasMoreElements()) {
        String attrName = ee.nextElement();
        map.put(attrName, getSessionAttribute(sessionId, attrName));
    }
    return map;
}

Example 90 with Session

use of org.apache.catalina.Session in project tomcat by apache.

the class ManagerBase method processExpires.

/**
 * Invalidate all sessions that have expired.
 */
public void processExpires() {
    long timeNow = System.currentTimeMillis();
    Session[] sessions = findSessions();
    int expireHere = 0;
    if (log.isDebugEnabled()) {
        log.debug("Start expire sessions " + getName() + " at " + timeNow + " sessioncount " + sessions.length);
    }
    for (Session session : sessions) {
        if (session != null && !session.isValid()) {
            expireHere++;
        }
    }
    long timeEnd = System.currentTimeMillis();
    if (log.isDebugEnabled()) {
        log.debug("End expire sessions " + getName() + " processingTime " + (timeEnd - timeNow) + " expired sessions: " + expireHere);
    }
    processingTime += (timeEnd - timeNow);
}