You are viewing a plain text version of this content. The canonical link for it is here.

Posted to user@shiro.apache.org by "rama.casturi" <ra...@gmail.com> on 2012/04/09 23:12:13 UTC

Sessions from different filters interfering with each other

Hi,

Here is a shiro filter configuration that I am trying and I believe sessions
created for the two form filters are interfering with each other.

         <bean id="shiroFilter"
class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
                 <property name="securityManager" ref="securityManager" />
                 <property name="filterChainDefinitions">
                         <value>
                                 /foo/**/** = fooFilter
                                 /bar/**/** = barFilter
                         </value>
                 </property>
         </bean>
 
         <bean id="fooFilter"
class="org.apache.shiro.web.filter.authc.FormAuthenticationFilter">
                 <property name="loginUrl" value="/foo/login" />
         </bean>
 
         <bean id="barFilter"
class="org.apache.shiro.web.filter.authc.FormAuthenticationFilter">
                 <property name="loginUrl" value="/bar/login" />
         </bean>
 
         <bean id="sessionManager"
class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
         </bean>
 
         <bean id="securityManager"
class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
                 <property name="realms">
                         <util:set>
                                 <ref bean="fooPagesAuthorizingRealm"/>
                                 <ref bean="barPagesAuthorizingRealm"/>
                         </util:set>
                 </property>
         </bean>

        *// This realm authenticate against users in one database*
        <bean id="fooPagesAuthorizingRealm"
class="com.xyz.FooPagesAuthorizingRealm">
                 <property name="credentialsMatcher"
ref="hashedPasswordMatcher" />
         </bean>

        *// This realm authenticate against users in a different database
from the above*
        <bean id="barPagesAuthorizingRealm"
class="com.xyz.FooPagesAuthorizingRealm">
                 <property name="credentialsMatcher"
ref="hashedPasswordMatcher" />
         </bean>

In the above configuration, all /foo/**/** urls are supposed to be
accessible only to a certain set of users, and /bar/**/** urls are
accessible to a different set of users.

What I am seeing though is, a user who logs to /foo/login successfully is
able to access any of the /bar/**/** urls. I guess this is because the
session that is created for this user when he logged into /foo/login is
letting him access the /bar/**/** urls as well.

Is this a bug or am I doing something wrong in my example? This is a valid
scenario in my application. Any help is appreciated.

Thanks
Rama

--
View this message in context: http://shiro-user.582556.n2.nabble.com/Sessions-from-different-filters-interfering-with-each-other-tp7451046p7451046.html
Sent from the Shiro User mailing list archive at Nabble.com.