public class SessionAuthenticator extends java.lang.Object implements Authenticator
Authenticator
that stores active sessions in a database and authenticate a request using
a session ID generated at login.Constructor and Description |
---|
SessionAuthenticator()
Deprecated.
Uses an insecure implementation of
Random . |
SessionAuthenticator(long sessionLifetime)
Deprecated.
Uses an insecure implementation of
Random . |
SessionAuthenticator(long sessionLifetime,
SessionDataAccess database)
Deprecated.
Uses an insecure implementation of
Random . |
SessionAuthenticator(java.util.Random random)
Constructs a
SessionAuthenticator with 1-hour-long sessions and using an in-memory database. |
SessionAuthenticator(java.util.Random random,
long sessionLifetime)
Constructs a
SessionAuthenticator with 1-hour-long sessions and using an in-memory database. |
SessionAuthenticator(java.util.Random random,
long sessionLifetime,
SessionDataAccess database)
Constructs a
SessionAuthenticator . |
Modifier and Type | Method and Description |
---|---|
java.lang.String |
authenticate(java.lang.String sessionID)
Authenticate using the given token.
|
protected long |
generateExpiration()
Generates the expiration date using the current real time.
|
protected java.lang.String |
generateSessionID()
Generates a new session ID encoded in base64.
|
java.lang.String |
login(java.lang.String uid)
Creates a new session with the given user identifier.
|
boolean |
logout(java.lang.String sessionID)
Removes the session identified by
sessionID from the active sessions. |
void |
refresh(java.lang.String sessionID)
Refreshes the expiration date of the session identified by
sessionID . |
@Deprecated public SessionAuthenticator()
Random
.SessionAuthenticator
with 1-hour-long sessions and using an in-memory database.InMemorySessionDataAccess
public SessionAuthenticator(java.util.Random random)
SessionAuthenticator
with 1-hour-long sessions and using an in-memory database.
Use a secure Random
implementation (see java.security.SecureRandom).random
- the random number generator used to create session IDs.InMemorySessionDataAccess
@Deprecated public SessionAuthenticator(long sessionLifetime)
Random
.SessionAuthenticator
using an in-memory database.sessionLifetime
- the time before a session is considered invalid.InMemorySessionDataAccess
public SessionAuthenticator(java.util.Random random, long sessionLifetime)
SessionAuthenticator
with 1-hour-long sessions and using an in-memory database.
Use a secure Random
implementation (see java.security.SecureRandom).random
- the random number generator used to create session IDs.sessionLifetime
- the time before a session is considered invalid.InMemorySessionDataAccess
@Deprecated public SessionAuthenticator(long sessionLifetime, SessionDataAccess database)
Random
.SessionAuthenticator
.sessionLifetime
- the time before a session is considered invalid.database
- the database to store active sessions.public SessionAuthenticator(java.util.Random random, long sessionLifetime, SessionDataAccess database)
SessionAuthenticator
.
Use a secure Random
implementation (see java.security.SecureRandom).random
- the random number generator used to create session IDs.sessionLifetime
- the time before a session is considered invalid.database
- the database to store active sessions.public java.lang.String login(java.lang.String uid)
uid
- the identifier of the logged in user.public java.lang.String authenticate(java.lang.String sessionID)
Authenticator
authenticate
in interface Authenticator
sessionID
- the token used for authentication.token
, or null if authentication failed.public void refresh(java.lang.String sessionID)
sessionID
.sessionID
- the identifier of the session.public boolean logout(java.lang.String sessionID)
sessionID
from the active sessions.sessionID
- the identifier of the session.false
if no sessions are referenced by sessionID
, true
otherwiseprotected java.lang.String generateSessionID()
protected long generateExpiration()
System.currentTimeMillis()