lprimak commented on PR #2711: URL: https://github.com/apache/shiro/pull/2711#issuecomment-4506697009
That is not going to be an issue as `subject` is the root of the object graph and there is only one session per subject > One question regarding the placement of the snapshot/restore in `beforeSuccessfulLogin()`: after `stopSession()` you call `subject.getSession()` to obtain the new session and restore the attributes into it — but `createSubject()` hasn't run yet at that point. Is there a guarantee that `createSubject()` will always reuse that intermediate session rather than creating another one? I'm wondering if snapshotting before `beforeSuccessfulLogin()` and restoring to the subject returned by `createSubject()` (i.e. directly in `login()`) would be more robust, since it operates on the final authenticated subject with no ambiguity about which session ends up in use. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
