Examples with SessionRegistryImpl org.springframework.security.core.session.SessionRegistryImpl used on opensource projects

Example 1 with SessionRegistryImpl

use of org.springframework.security.core.session.SessionRegistryImpl in project spring-security by spring-projects.

the class SessionManagementConfigurer method getSessionRegistry.

private SessionRegistry getSessionRegistry(H http) {
    if (this.sessionRegistry == null) {
        this.sessionRegistry = getBeanOrNull(SessionRegistry.class);
    }
    if (this.sessionRegistry == null) {
        SessionRegistryImpl sessionRegistry = new SessionRegistryImpl();
        registerDelegateApplicationListener(http, sessionRegistry);
        this.sessionRegistry = sessionRegistry;
    }
    return this.sessionRegistry;
}

Example 2 with SessionRegistryImpl

use of org.springframework.security.core.session.SessionRegistryImpl in project spring-security by spring-projects.

the class ConcurrentSessionFilterTests method returnsExpectedMessageWhenNoExpiredUrlSet.

// As above, but with no expiredUrl set.
@Test
public void returnsExpectedMessageWhenNoExpiredUrlSet() throws Exception {
    MockHttpServletRequest request = new MockHttpServletRequest();
    MockHttpSession session = new MockHttpSession();
    request.setSession(session);
    MockHttpServletResponse response = new MockHttpServletResponse();
    SessionRegistry registry = new SessionRegistryImpl();
    registry.registerNewSession(session.getId(), "principal");
    registry.getSessionInformation(session.getId()).expireNow();
    ConcurrentSessionFilter filter = new ConcurrentSessionFilter(registry);
    FilterChain fc = mock(FilterChain.class);
    filter.doFilter(request, response, fc);
    verifyZeroInteractions(fc);
    assertThat(response.getContentAsString()).isEqualTo("This session has been expired (possibly due to multiple concurrent logins being " + "attempted as the same user).");
}

Example 3 with SessionRegistryImpl

use of org.springframework.security.core.session.SessionRegistryImpl in project spring-security by spring-projects.

the class ConcurrentSessionFilterTests method detectsExpiredSessions.

@Test
public void detectsExpiredSessions() throws Exception {
    // Setup our HTTP request
    MockHttpServletRequest request = new MockHttpServletRequest();
    MockHttpSession session = new MockHttpSession();
    request.setSession(session);
    MockHttpServletResponse response = new MockHttpServletResponse();
    SessionRegistry registry = new SessionRegistryImpl();
    registry.registerNewSession(session.getId(), "principal");
    registry.getSessionInformation(session.getId()).expireNow();
    // Setup our test fixture and registry to want this session to be expired
    SimpleRedirectSessionInformationExpiredStrategy expiredSessionStrategy = new SimpleRedirectSessionInformationExpiredStrategy("/expired.jsp");
    ConcurrentSessionFilter filter = new ConcurrentSessionFilter(registry, expiredSessionStrategy);
    filter.setLogoutHandlers(new LogoutHandler[] { new SecurityContextLogoutHandler() });
    filter.afterPropertiesSet();
    FilterChain fc = mock(FilterChain.class);
    filter.doFilter(request, response, fc);
    // Expect that the filter chain will not be invoked, as we redirect to expiredUrl
    verifyZeroInteractions(fc);
    assertThat(response.getRedirectedUrl()).isEqualTo("/expired.jsp");
}

Example 4 with SessionRegistryImpl

use of org.springframework.security.core.session.SessionRegistryImpl in project spring-security by spring-projects.

the class ConcurrentSessionFilterTests method setLogoutHandlersWhenEmptyThenThrowsException.

@Test
public void setLogoutHandlersWhenEmptyThenThrowsException() {
    ConcurrentSessionFilter filter = new ConcurrentSessionFilter(new SessionRegistryImpl());
    assertThatIllegalArgumentException().isThrownBy(() -> filter.setLogoutHandlers(new LogoutHandler[0]));
}

Example 5 with SessionRegistryImpl

use of org.springframework.security.core.session.SessionRegistryImpl in project spring-security by spring-projects.

the class ConcurrentSessionFilterTests method lastRequestTimeUpdatesCorrectly.

@Test
public void lastRequestTimeUpdatesCorrectly() throws Exception {
    // Setup our HTTP request
    MockHttpServletRequest request = new MockHttpServletRequest();
    MockHttpSession session = new MockHttpSession();
    request.setSession(session);
    MockHttpServletResponse response = new MockHttpServletResponse();
    FilterChain fc = mock(FilterChain.class);
    // Setup our test fixture
    SessionRegistry registry = new SessionRegistryImpl();
    registry.registerNewSession(session.getId(), "principal");
    SimpleRedirectSessionInformationExpiredStrategy expiredSessionStrategy = new SimpleRedirectSessionInformationExpiredStrategy("/expired.jsp");
    ConcurrentSessionFilter filter = new ConcurrentSessionFilter(registry, expiredSessionStrategy);
    Date lastRequest = registry.getSessionInformation(session.getId()).getLastRequest();
    Thread.sleep(1000);
    filter.doFilter(request, response, fc);
    verify(fc).doFilter(request, response);
    assertThat(registry.getSessionInformation(session.getId()).getLastRequest().after(lastRequest)).isTrue();
}