DefaultWebSecurityManager isHttpSessionMode may be error?

[jitabc <ie...@qq.com>]

org.apache.shiro.web.mgt.DefaultWebSecurityManager.java


    /**
     * @since 1.0
     */
    public boolean isHttpSessionMode() {
        return this.sessionMode == null ||
this.sessionMode.equals(HTTP_SESSION_MODE);
    }
---------------------------------------------------------------------------------------
may be error,and i think this method should as bellow:


  public boolean isHttpSessionMode() {
        String sm = getSessionMode();
        return (sm!= null && sm.equals(HTTP_SESSION_MODE));
    }


--
View this message in context: http://shiro-developer.582600.n2.nabble.com/DefaultWebSecurityManager-isHttpSessionMode-may-be-error-tp6457753p6457753.html
Sent from the Shiro Developer mailing list archive at Nabble.com.

Re: DefaultWebSecurityManager isHttpSessionMode may be error?

[Les Hazlewood <lh...@apache.org>]

Hello,

Are you seeing a problem?  I think that if there were to be a change
for this, it would be:

return sm == null || !sm.equals(NATIVE_SESSION_MODE)

This way normal servlet container sessions are always used _unless_
the native mode is explicitly turned on.  If you feel this should be
changed, please open a Jira issue, and we can address it ASAP.

Thanks,

-- 
Les Hazlewood
CTO, Katasoft | http://www.katasoft.com | 888.391.5282
twitter: http://twitter.com/lhazlewood
katasoft blog: http://www.katasoft.com/blogs/lhazlewood
personal blog: http://leshazlewood.com