Examples with SessionException org.apache.shiro.session.SessionException used on opensource projects

Example 1 with SessionException

use of org.apache.shiro.session.SessionException in project shiro by apache.

the class LogoutFilter method preHandle.

/**
 * Acquires the currently executing {@link #getSubject(javax.servlet.ServletRequest, javax.servlet.ServletResponse) subject},
 * a potentially Subject or request-specific
 * {@link #getRedirectUrl(javax.servlet.ServletRequest, javax.servlet.ServletResponse, org.apache.shiro.subject.Subject) redirectUrl},
 * and redirects the end-user to that redirect url.
 *
 * @param request  the incoming ServletRequest
 * @param response the outgoing ServletResponse
 * @return {@code false} always as typically no further interaction should be done after user logout.
 * @throws Exception if there is any error.
 */
@Override
protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception {
    Subject subject = getSubject(request, response);
    // Check if POST only logout is enabled
    if (isPostOnlyLogout()) {
        // check if the current request's method is a POST, if not redirect
        if (!WebUtils.toHttp(request).getMethod().toUpperCase(Locale.ENGLISH).equals("POST")) {
            return onLogoutRequestNotAPost(request, response);
        }
    }
    String redirectUrl = getRedirectUrl(request, response, subject);
    // try/catch added for SHIRO-298:
    try {
        subject.logout();
    } catch (SessionException ise) {
        log.debug("Encountered session exception during logout.  This can generally safely be ignored.", ise);
    }
    issueRedirect(request, response, redirectUrl);
    return false;
}

Example 2 with SessionException

use of org.apache.shiro.session.SessionException in project ddf by codice.

the class WebSSOFilter method checkForPreviousResultOnSession.

private HandlerResult checkForPreviousResultOnSession(HttpServletRequest httpRequest, String ip) {
    String requestedSessionId = httpRequest.getRequestedSessionId();
    if (requestedSessionId == null) {
        LOGGER.trace("No HTTP Session - returning with no results");
        return null;
    }
    HttpSession session = httpRequest.getSession(false);
    if (session == null) {
        // has not yet been created for them.
        if (sessionFactory == null) {
            throw new SessionException("Unable to verify user's session.");
        }
        session = sessionFactory.getOrCreateSession(httpRequest);
    }
    // See if principals exist for the requested session id
    HandlerResult result = null;
    PrincipalHolder principalHolder = (PrincipalHolder) session.getAttribute(SecurityConstants.SECURITY_TOKEN_KEY);
    if (principalHolder != null && principalHolder.getPrincipals() != null) {
        Collection<SecurityAssertion> assertions = principalHolder.getPrincipals().byType(SecurityAssertion.class);
        SessionToken sessionToken = null;
        if (!assertions.isEmpty()) {
            sessionToken = new SessionToken(principalHolder.getPrincipals(), session.getId(), ip);
        }
        if (sessionToken != null) {
            result = new HandlerResultImpl();
            result.setToken(sessionToken);
            result.setStatus(HandlerResult.Status.COMPLETED);
        } else {
            principalHolder.remove();
        }
    } else {
        securityLogger.audit("Request contained invalid or expired session id [{}]", Hashing.sha256().hashString(requestedSessionId, StandardCharsets.UTF_8).toString());
        LOGGER.trace("Request contained invalid or expired session - returning with no results");
    }
    return result;
}