本文整理匯總了Java中javax.servlet.http.HttpServletRequest.isRequestedSessionIdValid方法的典型用法代碼示例。如果您正苦於以下問題：Java HttpServletRequest.isRequestedSessionIdValid方法的具體用法？Java HttpServletRequest.isRequestedSessionIdValid怎麽用？Java HttpServletRequest.isRequestedSessionIdValid使用的例子？那麽, 這裏精選的方法代碼示例或許可以為您提供幫助。您也可以進一步了解該方法所在類javax.servlet.http.HttpServletRequest的用法示例。
在下文中一共展示了HttpServletRequest.isRequestedSessionIdValid方法的2個代碼示例，這些例子默認根據受歡迎程度排序。您可以為喜歡或者感覺有用的代碼點讚，您的評價將有助於係統推薦出更棒的Java代碼示例。
示例1: assertAuthenticationIsValid
import javax.servlet.http.HttpServletRequest; //導入方法依賴的package包/類
/**
* Check the users session for validity
* @param req The users request
* @throws SecurityException if the users session is invalid
*/
protected void assertAuthenticationIsValid(HttpServletRequest req) throws SecurityException
{
// ensure that at least the next call has a valid session
req.getSession();
// if there was an expired session, the request has to fail
if (!req.isRequestedSessionIdValid())
{
throw new LoginRequiredException(Messages.getString("DefaultAccessControl.DeniedByInvalidSession"));
}
if (req.getRemoteUser() == null)
{
throw new LoginRequiredException(Messages.getString("DefaultAccessControl.DeniedByAuthenticationRequired"));
}
}
示例2: checkNotCsrfAttack
import javax.servlet.http.HttpServletRequest; //導入方法依賴的package包/類
/**
* Check that this request is not subject to a CSRF attack
* @param request The original browser's request
* @param sessionCookieName "JSESSIONID" unless it has been overridden
*/
private void checkNotCsrfAttack(HttpServletRequest request, String sessionCookieName)
{
// A check to see that this isn't a csrf attack
// http://en.wikipedia.org/wiki/Cross-site_request_forgery
// http://www.tux.org/~peterw/csrf.txt
if (request.isRequestedSessionIdValid() && request.isRequestedSessionIdFromCookie())
{
String headerSessionId = request.getRequestedSessionId();
if (headerSessionId.length() > 0)
{
String bodySessionId = getHttpSessionId();
// Normal case; if same session cookie is supplied by DWR and
// in HTTP header then all is ok
if (headerSessionId.equals(bodySessionId))
{
return;
}
// Weblogic adds creation time to the end of the incoming
// session cookie string (even for request.getRequestedSessionId()).
// Use the raw cookie instead
Cookie[] cookies = request.getCookies();
for (int i = 0; i < cookies.length; i++)
{
Cookie cookie = cookies[i];
if (cookie.getName().equals(sessionCookieName) &&
cookie.getValue().equals(bodySessionId))
{
return;
}
}
// Otherwise error
log.error("A request has been denied as a potential CSRF attack.");
throw new SecurityException("Session Error");
}
}
}