Nemcio/SCM-Manager
1
0
Fork 0
mirror of https://github.com/scm-manager/scm-manager.git synced 2026-02-05 22:29:11 +01:00
Code Issues Packages Projects Releases Activity

Disable shiro session storage

Browse Source 
We use JWT for session management, so we can disable shiro session management and this allows usage of SecurityManager outside of a http request.
This commit is contained in:
Sebastian Sdorra
2020-11-08 12:25:25 +01:00
parent d86b2f70c3
commit 36aa05986f
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
scm-webapp/src/main/java/sonia/scm/lifecycle/modules/ScmSecurityModule.java
View File

@@ -36,6 +36,9 @@ import org.apache.shiro.authc.pam.ModularRealmAuthenticator;
import org.apache.shiro.authz.permission.PermissionResolver;
import org.apache.shiro.crypto.hash.DefaultHashService;
import org.apache.shiro.guice.web.ShiroWebModule;
import org.apache.shiro.mgt.DefaultSessionStorageEvaluator;
import org.apache.shiro.mgt.DefaultSubjectDAO;
import org.apache.shiro.mgt.SubjectDAO;
import org.apache.shiro.realm.Realm;
import org.slf4j.Logger;
@@ -120,8 +123,18 @@ public class ScmSecurityModule extends ShiroWebModule
addFilterChain("/**.mustache", filterConfig(ROLES, "nobody"));
// disable session
disableSession();
}
private void disableSession() {
addFilterChain("/**", NO_SESSION_CREATION);
bindConstant().annotatedWith(Names.named("shiro.sessionStorageEnabled")).to(false);
DefaultSubjectDAO subjectDAO = new DefaultSubjectDAO();
DefaultSessionStorageEvaluator sessionStorageEvaluator = new DefaultSessionStorageEvaluator();
sessionStorageEvaluator.setSessionStorageEnabled(false);
subjectDAO.setSessionStorageEvaluator(sessionStorageEvaluator);
bind(SubjectDAO.class).toInstance(subjectDAO);
}
/**