Re: re: session timeout

Christian,

From the user's perspective, they log in once and they are logged in. The
filter remembers who the user is, but not what roles they are in. So, each
request that is protected by a role constraint will result in a call to the
realm to see if the user is in the role.

It is relatively straightforward to implement basic caching at the realm
level. One strategy is to keep track of what roles a user is in and then
dropping the cache for a particular user when a request to authenticate that
user is made (and perhaps after some timeout period). SecurityFilter
supports nesting an arbitrary number of realms, so you can layer in a
caching realm without too much trouble. This seems like something everyone
could use, so perhaps it should be part of the base functionality (so you
don't have to nest it in).

That would be a good project if someone is looking to make a contribution --
generic caching realm(s). But there are no caching realms in the
distribution at this time.

-Max

----- Original Message -----
From: "Christian Cabanero" <chumpboy-/[email protected]>
To: <securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org>
Sent: Monday, November 11, 2002 9:49 AM
Subject: [securityfilter-user] re: session timeout


> Hello,
>
> First off, let me just say that I'm really glad I
> found the securityfilter project on sourceforge!
>
> I'm trying to determine if securityfilter stores info
> in the user's session so that it doesn't have to
> actually invoke all the security checking once a user
> has already logged in.  From looking at the code, is
> that what the ALREADY_PROCESSED attribute is for?  So
> if it finds this set to "true" in the user's session
> it'll bypass the security check?  I noticed in the
> code that the attribute is set at the request level
> and not the session level as I would have assumed.
> Would this mean that the security check would get
> invoked with every new request?  If so, is this so
> that it can check the user's role against the
> protected resource as well?    My main concern is that
> explicitly invoking a security check for every request
> might slow things down.
>
> Thanks for any help,
> Christian
>
> __________________________________________________
> Do you Yahoo!?
> U2 on LAUNCH - Exclusive greatest hits videos
> http://launch.yahoo.com/u2
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> securityfilter-user mailing list
> securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> https://lists.sourceforge.net/lists/listinfo/securityfilter-user
>




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf