jodd.servlet.filter

Class RemoveSessionFromUrlFilter

java.lang.Object

jodd.servlet.filter.RemoveSessionFromUrlFilter

All Implemented Interfaces:

javax.servlet.Filter

public class RemoveSessionFromUrlFilter
extends java.lang.Object
implements javax.servlet.Filter

Protects from exposing session ids in URLs for security reasons. Does the following:

• invalidates session if session id is exposed in the URL
• removes session id from URLs.

Constructor Summary

Constructors

Constructor and Description
RemoveSessionFromUrlFilter()

Method Summary

Modifier and Type	Method and Description
void	destroy()
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain) Filters requests to remove URL-based session identifiers.
void	init(javax.servlet.FilterConfig config)
protected boolean	isRequestedSessionIdFromURL(javax.servlet.http.HttpServletRequest servletRequest) Detects if session ID exist in the URL.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

RemoveSessionFromUrlFilter

public RemoveSessionFromUrlFilter()

Method Detail

doFilter

public void doFilter(javax.servlet.ServletRequest request,
                     javax.servlet.ServletResponse response,
                     javax.servlet.FilterChain chain)
              throws java.io.IOException,
                     javax.servlet.ServletException

Filters requests to remove URL-based session identifiers.

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

java.io.IOException

javax.servlet.ServletException

isRequestedSessionIdFromURL

protected boolean isRequestedSessionIdFromURL(javax.servlet.http.HttpServletRequest servletRequest)

Detects if session ID exist in the URL. It works more reliable than servletRequest.isRequestedSessionIdFromURL().

init

public void init(javax.servlet.FilterConfig config)

Specified by:

init in interface javax.servlet.Filter

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter