Session Management

interface WebSessionManager extends SessionManager {
    /**
     * Returns whether this session manager uses servlet container sessions.
     *
     * @return true if using servlet container sessions
     */
    boolean isServletContainerSessions();
}

class DefaultWebSessionManager extends DefaultSessionManager implements WebSessionManager {
    public DefaultWebSessionManager();
    
    public boolean isServletContainerSessions();
    
    public Cookie getSessionIdCookie();
    public void setSessionIdCookie(Cookie cookie);
    
    public boolean isSessionIdUrlRewritingEnabled();
    public void setSessionIdUrlRewritingEnabled(boolean enabled);
    
    protected Serializable getSessionId(ServletRequest request, ServletResponse response);
    
    protected void storeSessionId(Serializable currentId, ServletRequest request, ServletResponse response);
}

class ServletContainerSessionManager implements WebSessionManager {
    public ServletContainerSessionManager();
    
    public boolean isServletContainerSessions();
    
    public Session start(SessionContext context);
    public Session getSession(SessionKey key) throws SessionException;
    
    public Collection<Session> getActiveSessions();
}

class NoSessionCreationFilter extends PathMatchingFilter {
    /**
     * Creates a new NoSessionCreationFilter that prevents session creation.
     */
    public NoSessionCreationFilter();
    
    /**
     * Disables session creation for the current request by setting the
     * SESSION_CREATION_ENABLED attribute to false.
     *
     * @param request the servlet request
     * @param response the servlet response
     * @param mappedValue the path-specific configuration
     * @return true to continue filter chain processing
     */
    protected boolean onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception;
}

public void configureSessionManagement() {
    DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
    
    // Native Shiro session management
    DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
    sessionManager.setGlobalSessionTimeout(30 * 60 * 1000); // 30 minutes
    sessionManager.setSessionIdUrlRewritingEnabled(false);
    
    // Configure session ID cookie
    SimpleCookie sessionCookie = new SimpleCookie("JSESSIONID");
    sessionCookie.setHttpOnly(true);
    sessionCookie.setSecure(true);
    sessionManager.setSessionIdCookie(sessionCookie);
    
    securityManager.setSessionManager(sessionManager);
}

public void configureSessionlessAPIs() {
    DefaultFilterChainManager filterChainManager = new DefaultFilterChainManager();
    
    // API endpoints should not create sessions
    filterChainManager.createChain("/api/**", "noSessionCreation, authcBasic");
    filterChainManager.createChain("/rest/**", "noSessionCreation, authcBearer");
    
    // Regular web paths can create sessions
    filterChainManager.createChain("/web/**", "authc");
    filterChainManager.createChain("/**", "anon");
    
    PathMatchingFilterChainResolver resolver = new PathMatchingFilterChainResolver();
    resolver.setFilterChainManager(filterChainManager);
}