(shiro) branch main updated: improvement: implemented session key rotation via changeSessionId() in Web-Container mode only

[lprimak]

This is an automated email from the ASF dual-hosted git repository.

lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro.git


The following commit(s) were added to refs/heads/main by this push:
     new a46600f2c improvement: implemented session key rotation via 
changeSessionId() in Web-Container mode only
a46600f2c is described below

commit a46600f2cf7856aae4e8507e1e4c7063447845e2
Author: lprimak <le...@flowlogix.com>
AuthorDate: Wed May 6 19:33:54 2026 -0500

    improvement: implemented session key rotation via changeSessionId() in 
Web-Container mode only
---
 .../java/org/apache/shiro/mgt/DefaultSecurityManager.java | 15 ++++++++++-----
 .../apache/shiro/web/mgt/DefaultWebSecurityManager.java   | 15 +++++++++++++++
 2 files changed, 25 insertions(+), 5 deletions(-)

diff --git 
a/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java 
b/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java
index 0f7b7e8c2..6ca07fc6f 100644
--- a/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java
+++ b/core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java
@@ -288,11 +288,7 @@ public class DefaultSecurityManager extends 
SessionsSecurityManager {
             throw ae;
         }
 
-        Session existingSession = subject.getSession(false);
-        if (existingSession != null) {
-            existingSession.stop();
-        }
-
+        beforeSuccessfulLogin(subject);
         Subject loggedIn = createSubject(token, info, subject);
 
         onSuccessfulLogin(token, info, loggedIn);
@@ -300,6 +296,15 @@ public class DefaultSecurityManager extends 
SessionsSecurityManager {
         return loggedIn;
     }
 
+    /**
+     * Invoked before a successful login is processed.  This implementation 
checks for an existing session and stops it
+     *
+     * @param subject Subject
+     */
+    protected void beforeSuccessfulLogin(Subject subject) {
+        stopSession(subject);
+    }
+
     protected void onSuccessfulLogin(AuthenticationToken token, 
AuthenticationInfo info, Subject subject) {
         rememberMeSuccessfulLogin(token, info, subject);
     }
diff --git 
a/web/src/main/java/org/apache/shiro/web/mgt/DefaultWebSecurityManager.java 
b/web/src/main/java/org/apache/shiro/web/mgt/DefaultWebSecurityManager.java
index 02b515c9a..2fce1c9e7 100644
--- a/web/src/main/java/org/apache/shiro/web/mgt/DefaultWebSecurityManager.java
+++ b/web/src/main/java/org/apache/shiro/web/mgt/DefaultWebSecurityManager.java
@@ -23,6 +23,7 @@ import org.apache.shiro.mgt.DefaultSubjectDAO;
 import org.apache.shiro.mgt.SessionStorageEvaluator;
 import org.apache.shiro.mgt.SubjectDAO;
 import org.apache.shiro.realm.Realm;
+import org.apache.shiro.session.Session;
 import org.apache.shiro.session.mgt.SessionContext;
 import org.apache.shiro.session.mgt.SessionKey;
 import org.apache.shiro.session.mgt.SessionManager;
@@ -38,6 +39,7 @@ import org.apache.shiro.web.session.mgt.WebSessionManager;
 import org.apache.shiro.web.subject.WebSubject;
 import org.apache.shiro.web.subject.WebSubjectContext;
 import org.apache.shiro.web.subject.support.DefaultWebSubjectContext;
+import org.apache.shiro.web.subject.support.WebDelegatingSubject;
 import org.apache.shiro.web.util.WebUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -252,6 +254,19 @@ public class DefaultWebSecurityManager extends 
DefaultSecurityManager implements
         }
     }
 
+    @Override
+    protected void beforeSuccessfulLogin(Subject subject) {
+        if (isHttpSessionMode()) {
+            Session session = subject.getSession(false);
+            if (session != null) {
+                WebUtils.toHttp(((WebDelegatingSubject) 
subject).getServletRequest()).changeSessionId();
+            }
+        } else {
+            super.beforeSuccessfulLogin(subject);
+        }
+    }
+
+
     @Override
     protected void beforeLogout(Subject subject) {
         super.beforeLogout(subject);