[jira] [Commented] (SHIRO-355) Concurrency issue with the runAs principles stored in the Session object

["Les Hazlewood (Commented) (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SHIRO-355?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13247482#comment-13247482 ] 

Les Hazlewood commented on SHIRO-355:
-------------------------------------

While we should support pluggable RunAs storage mechanisms regardless, what makes you think there was a concurrency issue?  

Session attribute visibility across requests is important for any request, regardless of whether the session attribute is a runAs collection or not.

What was the 'concurrency issue' exactly?  

                
> Concurrency issue with the runAs principles stored in the Session object
> ------------------------------------------------------------------------
>
>                 Key: SHIRO-355
>                 URL: https://issues.apache.org/jira/browse/SHIRO-355
>             Project: Shiro
>          Issue Type: Bug
>          Components: Subject
>    Affects Versions: 1.2.0
>            Reporter: Marinus Geuze
>            Priority: Minor
>         Attachments: Subject.java
>
>
> Hi,
> I am using the runAs functionality of Shiro. However I think that there is a design flaw in the implementation. Because the runAs principles are stored in the Session object. However when a user does a second request to the server, while the first request to the server is still running, then there is a concurrency issue with the stored runAs principles.
> This issue caused problems in our application which used JSF2.0 frontend.
> Therefore I have overridden the default behavior of the org.apache.shiro.subject.Subject class, by implementing our own Subject class. This class stores the runAs principles in the servletRequest object.  The concurrency issue is thereby fixed. See mine implementation in the attachment.
> Am I right that the current session implementation is incorrect? If so, please fix this bug. If not, is it an idea to make this a configuration choice in Shiro by using a storeRunAsPrinciplesInSession or storeRunAsPrincipleInServletRequest indicator?
> Greets,
> Marinus

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira