Httpshirorequest takeover session

Simple analysis of the jetty request processing process: http://my.oschina.net/u/782865/blog/505533

See how Shiro takes over the session; We know that the Web container is implemented with session management; to mask the default implementation of this container, you need to change the default implementation of the GetSession method of the request.

Shiro is implemented in this way: encapsulate the ordinary request into a wrap, which is shirohttpservletrequest;

Intercept the request and encapsulate it as shirohttpservletrequest through the interceptor, as follows

Shiro's Abstractshirofilter

Protected void dofilterinternal (servletrequest servletrequest, servletresponse  Servletresponse, final filterchain chain)              throws ServletException, IOException {         Throwable t = null;        try {             final ServletRequest request  = prepareservletrequest (Servletrequest, servletresponse, chain);//Execution Package              final ServletResponse response =  Prepareservletresponse (Request, servletresponse, chain);             final subject subject = createsubject (request, response );             //noinspection unchecked             subject.execute (new callable ()  {                 public object call ()  throws  Exception {                     updatesessionlastaccesstime (Request, response);                      Executechain (Request, response, chain);                     return null;                 }             });..

 @SuppressWarnings ({"Unuseddeclaration"})      protected servletrequest prepareservletrequest (servletrequest request,  Servletresponse response, filterchain chain)  {         ServletRequest toUse = request;        if  ( Request instanceof httpservletrequest)  {             HttpServletRequest http =  (HttpServletRequest)  request;             touse = wrapservletrequest (HTTP);         }        return toUse;     } 

Protected ServletRequest wrapservletrequest (HttpServletRequest orig) {return new Shirohttpservletrequest (orig, get    ServletContext (), ishttpsessions ()); }

default No containers the session implementation;

Then look at the GetSession method of Shirohttpservletrequest;

Public HttpSession getsession () {return getsession (true); }

Public httpsession getsession (boolean create)  {         HttpSession httpSession;        if  (Ishttpsessions ())  {//default is flase;            httpsession =  super.getsession (False);            if  (httpsession == null && create)  {                 //shiro 1.2: assert that creation  is enabled  (SHIRO-266):                 if  (webutils._issessioncreationenabled (this))  {                      Httpsession = super.getsessIon (create);                 }  else {                     throw newnosessioncreationexception ();                 }             }        } else {// Here is the session            if  implemented by Shiro ( This.session == null)  {                 boolean existing = getsubject (). GetSession (False)  != null;                 Session  Shirosession = getsubject (). getsession(create);                 if   (Shirosession != null)  {                     this.session = new shirohttpsession (Shirosession, this, this.servletcontext);                     if  (!existing)  {                          setattribute (referenced_session_is_new, boolean.true);                     }                 }             }            httpsession =  this.session;        }         return httpsession;    }

Then realize Shiro Sessiondao interface can want to save where, where;

Httpshirorequest takeover session