seg_yinzy
/
che-server
mirror of https://github.com/eclipse-che/che-server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fixup! Prevent session already invalidated error when logging in with different users simultaneously

7.20.x
Max Shaposhnik 2020-01-27 11:20:17 +02:00
parent 8718f61b3d
commit 925e94ed7e
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
multiuser/api/che-multiuser-api-authentication-commons/src/main/java/org/eclipse/che/multiuser/api/authentication/commons/filter/MultiUserEnvironmentInitializationFilter.java
View File

@ -11,6 +11,7 @@
*/
package org.eclipse.che.multiuser.api.authentication.commons.filter;
import static java.lang.String.format;
import static org.eclipse.che.multiuser.api.authentication.commons.Constants.CHE_SUBJECT_ATTRIBUTE;
import java.io.IOException;
@ -28,6 +29,8 @@ import org.eclipse.che.commons.subject.Subject;
import org.eclipse.che.multiuser.api.authentication.commons.SessionStore;
import org.eclipse.che.multiuser.api.authentication.commons.SubjectHttpRequestWrapper;
import org.eclipse.che.multiuser.api.authentication.commons.token.RequestTokenExtractor;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
/**
* Performs basic environment initialization actions as follows:
@ -44,6 +47,9 @@ import org.eclipse.che.multiuser.api.authentication.commons.token.RequestTokenEx
*/
public abstract class MultiUserEnvironmentInitializationFilter implements Filter {
private static final Logger LOG =
LoggerFactory.getLogger(MultiUserEnvironmentInitializationFilter.class);
private final SessionStore sessionStore;
private final RequestTokenExtractor tokenExtractor;
@ -119,6 +125,10 @@ public abstract class MultiUserEnvironmentInitializationFilter implements Filter
sessionSubject = extractSubject(token);
session.setAttribute(CHE_SUBJECT_ATTRIBUTE, sessionSubject);
} else if (!sessionSubject.getUserId().equals(userId)) {
LOG.debug(
format(
"Invalidating session with mismatched user IDs: old was %s, new is %s.",
sessionSubject.getUserId(), userId));
session.invalidate();
HttpSession new_session = httpRequest.getSession(true);
sessionSubject = extractSubject(token);