Package auth.gui

Class AuthSessionCookie

  • All Implemented Interfaces:
    AuthAction.AuthMethod

    public class AuthSessionCookie
    extends java.lang.Object
    implements AuthAction.AuthMethod
    This class defines authentication via session cookies (which is the default authentication in the Play Framework).

    It checks Play's session cookie and does authorization. It has several layers of security:

    1) First, it checks if a username is in Play's session cookie and if this username belongs to a user in the database.

    2) Check if the session timed out. The time span is defined in the application.conf.

    3) Check if the session timed out due to inactivity of the user. With each request by the user, the time of last activity gets refreshed in the session.

    4) Check if the signed-in user has the proper Role needed to access this page. This Role is an optional parameter in the AuthAction.Auth annotation.

    5) It checks if the user was deactivated by an admin.

    The AuthAction.Auth annotation does not check the user's password. This is done once during signing in (class Signin).

    The User object is put in the RequestScope for later use during request processing.