You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@shiro.apache.org by "Todd Kofford (JIRA)" <ji...@apache.org> on 2008/11/05 17:49:44 UTC
[jira] Created: (JSEC-23) Session Timeout - Unconditional
Session Timeout - Unconditional
-------------------------------
Key: JSEC-23
URL: https://issues.apache.org/jira/browse/JSEC-23
Project: JSecurity
Issue Type: Bug
Components: Session Management
Reporter: Todd Kofford
The SimpleSession class is expiring sessions unconditionally after the default timeout of 30 minutes, regardless of any reads or writes to the session.
This issue is caused by the lastAccessTime field of the SimpleSession class not being updated when a session attribute is read or written. Since session expiration is dependent on the lastAccessTime value, this field needs to be updated each time a session attribute is read or written to the session.
The fix for this issue would be to call the touch() method of the SimpleSession class each time an attribute is read or written to the session. Since the touch() method updates the lastAccessTime field with the current time, this call is sufficient to perform the update that is required.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (JSEC-23) Session Timeout - Unconditional
Posted by "Todd Kofford (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JSEC-23?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Todd Kofford updated JSEC-23:
-----------------------------
Attachment: sessionExpiration.patch
This patch will solve the Unconditional Session Expiration/Timeout issue.
> Session Timeout - Unconditional
> -------------------------------
>
> Key: JSEC-23
> URL: https://issues.apache.org/jira/browse/JSEC-23
> Project: JSecurity
> Issue Type: Bug
> Components: Session Management
> Reporter: Todd Kofford
> Attachments: sessionExpiration.patch
>
> Original Estimate: 2h
> Remaining Estimate: 2h
>
> The SimpleSession class is expiring sessions unconditionally after the default timeout of 30 minutes, regardless of any reads or writes to the session.
> This issue is caused by the lastAccessTime field of the SimpleSession class not being updated when a session attribute is read or written. Since session expiration is dependent on the lastAccessTime value, this field needs to be updated each time a session attribute is read or written to the session.
> The fix for this issue would be to call the touch() method of the SimpleSession class each time an attribute is read or written to the session. Since the touch() method updates the lastAccessTime field with the current time, this call is sufficient to perform the update that is required.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Moved: (KI-12) Session Timeout - Unconditional
Posted by "Alan Cabrera (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/KI-12?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Alan Cabrera moved JSEC-23 to KI-12:
------------------------------------
Fix Version/s: (was: 0.9)
Component/s: (was: Session Management)
Affects Version/s: (was: 0.9-RC1)
Key: KI-12 (was: JSEC-23)
Project: Ki (was: JSecurity)
> Session Timeout - Unconditional
> -------------------------------
>
> Key: KI-12
> URL: https://issues.apache.org/jira/browse/KI-12
> Project: Ki
> Issue Type: Bug
> Reporter: Todd Kofford
> Assignee: Alan Cabrera
> Attachments: sessionExpiration.patch
>
> Original Estimate: 2h
> Remaining Estimate: 2h
>
> The SimpleSession class is expiring sessions unconditionally after the default timeout of 30 minutes, regardless of any reads or writes to the session.
> This issue is caused by the lastAccessTime field of the SimpleSession class not being updated when a session attribute is read or written. Since session expiration is dependent on the lastAccessTime value, this field needs to be updated each time a session attribute is read or written to the session.
> The fix for this issue would be to call the touch() method of the SimpleSession class each time an attribute is read or written to the session. Since the touch() method updates the lastAccessTime field with the current time, this call is sufficient to perform the update that is required.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (JSEC-23) Session Timeout - Unconditional
Posted by "Alan Cabrera (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JSEC-23?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Alan Cabrera resolved JSEC-23.
------------------------------
Resolution: Fixed
Applied. Thanks Todd!
> Session Timeout - Unconditional
> -------------------------------
>
> Key: JSEC-23
> URL: https://issues.apache.org/jira/browse/JSEC-23
> Project: JSecurity
> Issue Type: Bug
> Components: Session Management
> Affects Versions: 0.9-RC1
> Reporter: Todd Kofford
> Assignee: Alan Cabrera
> Fix For: 0.9
>
> Attachments: sessionExpiration.patch
>
> Original Estimate: 2h
> Remaining Estimate: 2h
>
> The SimpleSession class is expiring sessions unconditionally after the default timeout of 30 minutes, regardless of any reads or writes to the session.
> This issue is caused by the lastAccessTime field of the SimpleSession class not being updated when a session attribute is read or written. Since session expiration is dependent on the lastAccessTime value, this field needs to be updated each time a session attribute is read or written to the session.
> The fix for this issue would be to call the touch() method of the SimpleSession class each time an attribute is read or written to the session. Since the touch() method updates the lastAccessTime field with the current time, this call is sufficient to perform the update that is required.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (JSEC-23) Session Timeout - Unconditional
Posted by "Alan Cabrera (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/JSEC-23?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Alan Cabrera updated JSEC-23:
-----------------------------
Fix Version/s: 0.9
Assignee: Alan Cabrera
Affects Version/s: 0.9-RC1
> Session Timeout - Unconditional
> -------------------------------
>
> Key: JSEC-23
> URL: https://issues.apache.org/jira/browse/JSEC-23
> Project: JSecurity
> Issue Type: Bug
> Components: Session Management
> Affects Versions: 0.9-RC1
> Reporter: Todd Kofford
> Assignee: Alan Cabrera
> Fix For: 0.9
>
> Attachments: sessionExpiration.patch
>
> Original Estimate: 2h
> Remaining Estimate: 2h
>
> The SimpleSession class is expiring sessions unconditionally after the default timeout of 30 minutes, regardless of any reads or writes to the session.
> This issue is caused by the lastAccessTime field of the SimpleSession class not being updated when a session attribute is read or written. Since session expiration is dependent on the lastAccessTime value, this field needs to be updated each time a session attribute is read or written to the session.
> The fix for this issue would be to call the touch() method of the SimpleSession class each time an attribute is read or written to the session. Since the touch() method updates the lastAccessTime field with the current time, this call is sufficient to perform the update that is required.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.