This is an automated email from the ASF dual-hosted git repository. lprimak pushed a commit to branch 3.x in repository https://gitbox.apache.org/repos/asf/shiro.git
commit 5aaba1d03f5fe6317b77c44fbb050d0899b8d57b Author: lprimak <[email protected]> AuthorDate: Fri Jun 12 20:49:09 2026 -0500 chore: remove deprecated RandomSessionIdGenerator class and reference to it in SessionIdGenerator interface --- .../session/mgt/eis/RandomSessionIdGenerator.java | 72 ---------------------- .../shiro/session/mgt/eis/SessionIdGenerator.java | 1 - 2 files changed, 73 deletions(-) diff --git a/core/src/main/java/org/apache/shiro/session/mgt/eis/RandomSessionIdGenerator.java b/core/src/main/java/org/apache/shiro/session/mgt/eis/RandomSessionIdGenerator.java deleted file mode 100644 index 0689b8ab2..000000000 --- a/core/src/main/java/org/apache/shiro/session/mgt/eis/RandomSessionIdGenerator.java +++ /dev/null @@ -1,72 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.shiro.session.mgt.eis; - -import org.apache.shiro.session.Session; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; - -import java.io.Serializable; -import java.util.Random; - -/** - * Generates session IDs by using a {@link Random} instance to generate random IDs. The default {@code Random} - * implementation is a {@link java.security.SecureRandom SecureRandom} with the {@code SHA1PRNG} algorithm. - * - * @since 1.0 - * @deprecated since 2.2.1. Use {@link JavaUuidSessionIdGenerator} instead, as this class is no longer considered - * secure by modern standards. - */ -@Deprecated(forRemoval = true, since = "2.2.1") -public class RandomSessionIdGenerator implements SessionIdGenerator { - - private static final Logger LOGGER = LoggerFactory.getLogger(RandomSessionIdGenerator.class); - - private static final String RANDOM_NUM_GENERATOR_ALGORITHM_NAME = "SHA1PRNG"; - private Random random; - - public RandomSessionIdGenerator() { - try { - this.random = java.security.SecureRandom.getInstance(RANDOM_NUM_GENERATOR_ALGORITHM_NAME); - } catch (java.security.NoSuchAlgorithmException e) { - LOGGER.debug("The SecureRandom SHA1PRNG algorithm is not available on the current platform. Using the " - + "platform's default SecureRandom algorithm.", e); - this.random = new java.security.SecureRandom(); - } - } - - public Random getRandom() { - return this.random; - } - - public void setRandom(Random random) { - this.random = random; - } - - /** - * Returns the String value of the configured {@link Random}'s {@link Random#nextLong() nextLong()} invocation. - * - * @param session the {@link Session} instance to which the ID will be applied. - * @return the String value of the configured {@link Random}'s {@link Random#nextLong()} invocation. - */ - public Serializable generateId(Session session) { - //ignore the argument - just call the Random: - return Long.toString(getRandom().nextLong()); - } -} diff --git a/core/src/main/java/org/apache/shiro/session/mgt/eis/SessionIdGenerator.java b/core/src/main/java/org/apache/shiro/session/mgt/eis/SessionIdGenerator.java index c8a5ea1ec..d737af4a4 100644 --- a/core/src/main/java/org/apache/shiro/session/mgt/eis/SessionIdGenerator.java +++ b/core/src/main/java/org/apache/shiro/session/mgt/eis/SessionIdGenerator.java @@ -35,7 +35,6 @@ import java.io.Serializable; * store, you can implement this interface and typically inject it into an {@link AbstractSessionDAO} instance. * * @see org.apache.shiro.session.mgt.eis.JavaUuidSessionIdGenerator JavaUuidSessionIdGenerator - * @see org.apache.shiro.session.mgt.eis.RandomSessionIdGenerator RandomSessionIdGenerator * @since 1.0 */ public interface SessionIdGenerator {
