You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@shiro.apache.org by Les Hazlewood <lh...@apache.org> on 2010/05/07 23:10:44 UTC

Re: How do you want session auto re-creation after expiration to work?

I've been thinking about this a lot for the last couple of days, and
in light of the following two things, I'm not sure if we should be
doing this at the moment for standalone applications (web applications
already have the auto re-creation behavior as it is standard
servlet-container behavior).

1) It'd be nice to be code complete for 1.0 this week so we can begin
the ASF voting process next week - this would probably push out the
timeline further, and
2) Session automatic re-creation in the  event of an expired session
is a behavior found in webapps only, and the web-tier is inherently
client-specific.

That is, for #2, the web tier is a client-tier technology layer,
indicating the client is responsible for determining what to do in the
event that a referenced session does not exist or is expired.  Web
requests lend themselves well to the easy create or re-create logic
since it can be done in a filter before anything else processes the
request.  This is not necessarily true for standalone applications,
where the client model can be anything.  I'm not sure at the moment
how this should be done, or if it should be done at all (i.e. is this
a client-tier concern always)?

Given the tight timeline, I'd like to hold off working on this until
1.1 unless anyone feels otherwise.

- Les

On Wed, May 5, 2010 at 10:14 AM, Les Hazlewood <lh...@apache.org> wrote:
> What should the expected behavior be?  How do you want this to work?
> Anyone who wants a say in how they'd like this to work for their own
> applications, please let us know so we can ensure it works for the 1.0
> release next week.
>
> Thanks,
>
> Les
>