001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing,
013 * software distributed under the License is distributed on an
014 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015 * KIND, either express or implied.  See the License for the
016 * specific language governing permissions and limitations
017 * under the License.
018 */
019package org.apache.shiro.spring.web.config;
020
021import org.apache.shiro.mgt.RememberMeManager;
022import org.apache.shiro.mgt.SessionStorageEvaluator;
023import org.apache.shiro.mgt.SessionsSecurityManager;
024import org.apache.shiro.mgt.SubjectFactory;
025import org.apache.shiro.session.mgt.SessionManager;
026import org.apache.shiro.spring.config.AbstractShiroConfiguration;
027import org.apache.shiro.spring.web.ShiroUrlPathHelper;
028import org.apache.shiro.web.mgt.CookieRememberMeManager;
029import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
030import org.apache.shiro.web.mgt.DefaultWebSessionStorageEvaluator;
031import org.apache.shiro.web.mgt.DefaultWebSubjectFactory;
032import org.apache.shiro.web.servlet.Cookie;
033import org.apache.shiro.web.servlet.SimpleCookie;
034import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
035import org.apache.shiro.web.session.mgt.ServletContainerSessionManager;
036import org.springframework.beans.factory.annotation.Value;
037
038/**
039 * @since 1.4.0
040 */
041public class AbstractShiroWebConfiguration extends AbstractShiroConfiguration {
042
043    @Value("#{ @environment['shiro.sessionManager.sessionIdCookieEnabled'] ?: true }")
044    protected boolean sessionIdCookieEnabled;
045
046    @Value("#{ @environment['shiro.sessionManager.sessionIdUrlRewritingEnabled'] ?: false }")
047    protected boolean sessionIdUrlRewritingEnabled;
048
049    @Value("#{ @environment['shiro.userNativeSessionManager'] ?: false }")
050    protected boolean useNativeSessionManager;
051
052    // Session Cookie info
053    @Value("#{ @environment['shiro.sessionManager.cookie.name'] ?:"
054            + " T(org.apache.shiro.web.servlet.ShiroHttpSession).DEFAULT_SESSION_ID_NAME }")
055    protected String sessionIdCookieName;
056
057    @Value("#{ @environment['shiro.sessionManager.cookie.maxAge'] ?:"
058            + " T(org.apache.shiro.web.servlet.SimpleCookie).DEFAULT_MAX_AGE }")
059    protected int sessionIdCookieMaxAge;
060
061    @Value("#{ @environment['shiro.sessionManager.cookie.domain'] ?: null }")
062    protected String sessionIdCookieDomain;
063
064    @Value("#{ @environment['shiro.sessionManager.cookie.path'] ?: null }")
065    protected String sessionIdCookiePath;
066
067    @Value("#{ @environment['shiro.sessionManager.cookie.secure'] ?: false }")
068    protected boolean sessionIdCookieSecure;
069
070    @Value("#{ @environment['shiro.sessionManager.cookie.sameSite'] ?:"
071            + " T(org.apache.shiro.web.servlet.Cookie.SameSiteOptions).LAX  }")
072    protected Cookie.SameSiteOptions sessionIdCookieSameSite;
073
074
075    // RememberMe Cookie info
076
077    @Value("#{ @environment['shiro.rememberMeManager.cookie.name'] ?:"
078            + " T(org.apache.shiro.web.mgt.CookieRememberMeManager).DEFAULT_REMEMBER_ME_COOKIE_NAME }")
079    protected String rememberMeCookieName;
080
081    @Value("#{ @environment['shiro.rememberMeManager.cookie.maxAge'] ?: T(org.apache.shiro.web.servlet.Cookie).ONE_YEAR }")
082    protected int rememberMeCookieMaxAge;
083
084    @Value("#{ @environment['shiro.rememberMeManager.cookie.domain'] ?: null }")
085    protected String rememberMeCookieDomain;
086
087    @Value("#{ @environment['shiro.rememberMeManager.cookie.path'] ?: null }")
088    protected String rememberMeCookiePath;
089
090    @Value("#{ @environment['shiro.rememberMeManager.cookie.secure'] ?: false }")
091    protected boolean rememberMeCookieSecure;
092
093    @Value("#{ @environment['shiro.rememberMeManager.cookie.sameSite'] ?:"
094            + " T(org.apache.shiro.web.servlet.Cookie.SameSiteOptions).LAX }")
095    protected Cookie.SameSiteOptions rememberMeSameSite;
096
097
098    protected SessionManager nativeSessionManager() {
099        DefaultWebSessionManager webSessionManager = new DefaultWebSessionManager();
100        webSessionManager.setSessionIdCookieEnabled(sessionIdCookieEnabled);
101        webSessionManager.setSessionIdUrlRewritingEnabled(sessionIdUrlRewritingEnabled);
102        webSessionManager.setSessionIdCookie(sessionCookieTemplate());
103
104        webSessionManager.setSessionFactory(sessionFactory());
105        webSessionManager.setSessionDAO(sessionDAO());
106        webSessionManager.setDeleteInvalidSessions(sessionManagerDeleteInvalidSessions);
107
108        return webSessionManager;
109    }
110
111    protected Cookie sessionCookieTemplate() {
112        return buildCookie(
113                sessionIdCookieName,
114                sessionIdCookieMaxAge,
115                sessionIdCookiePath,
116                sessionIdCookieDomain,
117                sessionIdCookieSecure,
118                sessionIdCookieSameSite);
119    }
120
121    protected Cookie rememberMeCookieTemplate() {
122        return buildCookie(
123                rememberMeCookieName,
124                rememberMeCookieMaxAge,
125                rememberMeCookiePath,
126                rememberMeCookieDomain,
127                rememberMeCookieSecure,
128                rememberMeSameSite);
129    }
130
131    protected Cookie buildCookie(String name, int maxAge, String path, String domain, boolean secure) {
132        return buildCookie(name, maxAge, path, domain, secure, Cookie.SameSiteOptions.LAX);
133    }
134
135    protected Cookie buildCookie(String name, int maxAge, String path, String domain,
136                                 boolean secure, Cookie.SameSiteOptions sameSiteOption) {
137        Cookie cookie = new SimpleCookie(name);
138        cookie.setHttpOnly(true);
139        cookie.setMaxAge(maxAge);
140        cookie.setPath(path);
141        cookie.setDomain(domain);
142        cookie.setSecure(secure);
143        cookie.setSameSite(sameSiteOption);
144
145        return cookie;
146    }
147
148    @Override
149    protected SessionManager sessionManager() {
150        if (useNativeSessionManager) {
151            return nativeSessionManager();
152        }
153        return new ServletContainerSessionManager();
154    }
155
156    @Override
157    protected RememberMeManager rememberMeManager() {
158        CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
159        cookieRememberMeManager.setCookie(rememberMeCookieTemplate());
160        return cookieRememberMeManager;
161    }
162
163    @Override
164    protected SubjectFactory subjectFactory() {
165        return new DefaultWebSubjectFactory();
166    }
167
168    @Override
169    protected SessionStorageEvaluator sessionStorageEvaluator() {
170        return new DefaultWebSessionStorageEvaluator();
171    }
172
173    @Override
174    protected SessionsSecurityManager createSecurityManager() {
175
176        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
177        securityManager.setSubjectDAO(subjectDAO());
178        securityManager.setSubjectFactory(subjectFactory());
179        securityManager.setRememberMeManager(rememberMeManager());
180
181        return securityManager;
182    }
183
184    protected ShiroFilterChainDefinition shiroFilterChainDefinition() {
185        DefaultShiroFilterChainDefinition chainDefinition = new DefaultShiroFilterChainDefinition();
186        chainDefinition.addPathDefinition("/**", "authc");
187        return chainDefinition;
188    }
189
190    protected ShiroUrlPathHelper shiroUrlPathHelper() {
191        return new ShiroUrlPathHelper();
192    }
193}