public class AuthActionSessionCookie
extends java.lang.Object
It checks Play's session cookie and the cached user session. Additionally, it does authorization. It sets the user's lastSeen time. It has several layers of security:
1) First it checks if a username is in Play's session cookie and if this username belongs to a user in the database.
2) We check whether the session ID stored in Play's session cookie is the same as stored in the UserSession in the cache. After a user logs out this session ID is deleted in the cache and from the session cookie and thus subsequent log-ins will fail.
3) Check if the session timed out. The time span is defined in the application.conf.
4) Check if the session timed out due to inactivity of the user. With each request by the user the time of last activity gets refreshed in the session.
5) Check if the logged-in user has the proper Role needed to access this page. This Role is an optional parameter in
the AuthAction.Auth annotation.
6) It checks if the user was deactivated by an admin.
The AuthAction.Auth annotation does not check the user's password. This is
done once during login (class SignIn).
The User object is put in the RequestScope for later use during request processing.
| Modifier and Type | Class and Description |
|---|---|
static class |
auth.gui.AuthAction.IAuth.AuthResult
Result for an auth attempt.
|
| Modifier and Type | Method and Description |
|---|---|
auth.gui.AuthAction.IAuth.AuthResult |
authenticate(play.mvc.Http.Request request,
User.Role role) |
public auth.gui.AuthAction.IAuth.AuthResult authenticate(play.mvc.Http.Request request,
User.Role role)
request - This action's Http.Request objectrole - Role the user must have to access the resourceResult only if auth was unsuccessful. Otherwise, the Optional is empty.