Re: [RE-POST] Should re-authentication invalidate session?

On Thu, 2003-10-16 at 12:26, Robert Taylor wrote:
> Okay. I'll try again. If this isn't the appropriate list for this
> type of question, please let me know.
> 
> robert

It is probably correct to reinvalidate the session. 

The code should probaly check if the new principal equals the old one,
and if not invalidate the session.

> <original-message>
> If I am prompted to authenticate myself by SecurityFilter,
> and I am successfully authenticated, then I voluntarily
> access the login page and authenticate myself as a different
> user, should the session for the old user be invalidated?
> 
> The following code found in the FormAuthenticator.processLogin() prompted
> me to ask this question:
> 
> if (principal != null) {
>    // login successful
>    // invalidate old session if the user was already authenticated
>    // NOTE: we may want to check if the user re-authenticated as the same
> user, currently
>    // the session will be invalidated even if the user authenticates as the
> same user.
>    request.setUserPrincipal(principal);
>    String continueToURL = getContinueToURL(request);
>    // This is the url that the user was initially accessing before being
> prompted for login.
>    response.sendRedirect(response.encodeRedirectURL(continueToURL));
> } else {
>    // login failed
>    // set response status and forward to error page
>    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
>    request.getRequestDispatcher(errorPage).forward(request, response);
> }
> 
> I don't see where the session is invalidated.
> I also looked in ServletRequestWrapper.setUserPrincipal() and it doesn't
> appear that
> the session is invalidated there either.
> 
> 
> robert
> </original-message>
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: SF.net Giveback Program.
> SourceForge.net hosts over 70,000 Open Source Projects.
> See the people who have HELPED US provide better services:
> Click here: http://sourceforge.net/supporters.php
> _______________________________________________
> securityfilter-user mailing list
> securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> https://lists.sourceforge.net/lists/listinfo/securityfilter-user
-- 
Torgeir Veimo <[email protected]>



-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better services:
Click here: http://sourceforge.net/supporters.php