Record Class TimeoutSessionPolicy.Config

java.lang.Object
java.lang.Record
com.svenruppert.jsentinel.session.TimeoutSessionPolicy.Config
Record Components:
idleTimeout - maximum allowed time since the last observed activity before the session is treated as idle-timeout
absoluteLifetime - maximum allowed time since session creation, regardless of activity
rotateSessionAfterLogin - if true, onLogin returns Invalidate so the adapter rotates the HTTP session id
loginRoute - route used for the Invalidate decision in the beforeNavigation context (ignored after login rotation)
Enclosing class:
TimeoutSessionPolicy<U>
public static record TimeoutSessionPolicy.Config(Duration idleTimeout, Duration absoluteLifetime, boolean rotateSessionAfterLogin, String loginRoute) extends Record
Tunable thresholds.

When rotateSessionAfterLogin is true, TimeoutSessionPolicy.onLogin(SessionContext) returns SessionDecision.Invalidate so the calling adapter rotates the underlying session id. The Vaadin LoginView honours this by calling VaadinService.reinitializeSession(VaadinRequest) — the VaadinSession (and therefore the just-bound subject) survives the rotation; only the HTTP session id changes. The REST adapter has no equivalent — tokens themselves are the session, and there is no fixation surface to mitigate.

  • Constructor Details

    • Config

      public Config(Duration idleTimeout, Duration absoluteLifetime, boolean rotateSessionAfterLogin, String loginRoute)
      Creates an instance of a Config record class.
      Parameters:
      idleTimeout - the value for the idleTimeout record component
      absoluteLifetime - the value for the absoluteLifetime record component
      rotateSessionAfterLogin - the value for the rotateSessionAfterLogin record component
      loginRoute - the value for the loginRoute record component

  • Method Details

    • defaults

      public static TimeoutSessionPolicy.Config defaults()
      Sensible defaults — 30 min idle, 12 h absolute, rotate after login, /login.

    • toString

      public final String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. Reference components are compared with Objects::equals(Object,Object); primitive components are compared with the compare method from their corresponding wrapper classes.
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • idleTimeout

      public Duration idleTimeout()
      Returns the value of the idleTimeout record component.
      Returns:
      the value of the idleTimeout record component

    • absoluteLifetime

      public Duration absoluteLifetime()
      Returns the value of the absoluteLifetime record component.
      Returns:
      the value of the absoluteLifetime record component

    • rotateSessionAfterLogin

      public boolean rotateSessionAfterLogin()
      Returns the value of the rotateSessionAfterLogin record component.
      Returns:
      the value of the rotateSessionAfterLogin record component

    • loginRoute

      public String loginRoute()
      Returns the value of the loginRoute record component.
      Returns:
      the value of the loginRoute record component