Stateless approach for REST API

[animator013]

Hi there,

i was wondering how to manage specific urls not to use session but a different realm (that is easy) and stateless approach (not sure the best way how to handle this).

Maybe I can use this specific filter https://shiro.apache.org/static/1.3.0/apidocs/org/apache/shiro/web/filter/session/NoSessionCreationFilter.html. Don't know if that is the best approach, if it is maybe we can incorporate this as a setting in the plugin ?

Also there is an .ini file settings here https://shiro.apache.org/session-management.html#web-applications for specific urls, but as we are using grails and a grails plugin, wondering if this is possible.

I know this is doable without shiro but as I am using it maybe it would be better to use shiro for everything security related.

Can you help me with this ?

[animator013]

It seems this from NoSessionCreationFilter is enough to paste to before method in Interceptor.

request.setAttribute(DefaultSubjectContext.SESSION_CREATION_ENABLED, Boolean.FALSE)

Maybe we can create a metaclass method stateless() in the Interceptor class to inject this one-line ? Or static variable to control this ?

[pmcneil]

Hmm, yes I've implemented a stateless/sessionless api access - which is related to the JWTRealm I'm implementing - a couple of times....
I have a case where both stateless and statefull are implemented, using ApiSessionStorageEvaluator to determine iff a session is required. in a simplified way it looks like this:

    boolean isSessionStorageEnabled(Subject subject) {
        String api = subject.principals.find { it == 'api' || it == 'jwt' }
        if (api) {
            return false
        }
        return true
    }

maybe add a new security.shiro.session.mode for the simpler case of no session at all?

[animator013]

So you've added subjectDao and evaluator beans to the plugin ?

Because that would be awesome and I am looking forward to it :)

[animator013]

Hi there @pmcneil. Do you have any ETA on this ? Do you have your JWTRealm done ?

Would like to remove that ugly line from my codebase
request.setAttribute(DefaultSubjectContext.SESSION_CREATION_ENABLED, Boolean.FALSE)

If you are not ready with this, maybe I'll make a PR so the subjectDao bean can be overriden.

Thanks, hope you are well :)