Module io.inverno.mod.session

Package io.inverno.mod.session.internal.jwt

Class JWTESessionIdGenerator<A,B>

java.lang.Object

io.inverno.mod.session.internal.jwt.JWTESessionIdGenerator<A,B>

Type Parameters:

A - the session data type

B - the stateless session data type

All Implemented Interfaces:

JWTSessionIdGenerator<A,B>, SessionIdGenerator<A,JWTSession<A,B>>

public class JWTESessionIdGenerator<A,B>
extends Object

A JWT session id generator that generates JWT as JWE which guarantees both integrity and confidentiality of the stateless session data within the session id.

When specified, the issuer is validated when reading JWT session identifier.

Since:

1.13

Author:

Jeremy Kuhn

Field Summary

Fields

Modifier and Type	Field	Description
protected final String	issuer	The JWT issuer.
protected final JWTService	jwtService	The JWT service.

Fields inherited from interface io.inverno.mod.session.jwt.JWTSessionIdGenerator

CLAIM_MAX_INACTIVE_INTERVAL, CLAIM_SESSION_DATA

Constructor Summary

Constructors

Constructor	Description
JWTESessionIdGenerator(JWTService jwtService, Consumer<JWEHeaderConfigurator<?>> headerConfigurer)	Creates a JWE JWT session id generator.
JWTESessionIdGenerator(JWTService jwtService, Consumer<JWEHeaderConfigurator<?>> headerConfigurer, String issuer)	Creates a JWE JWT session id generator.

Method Summary

Modifier and Type	Method	Description
protected Mono<JWE<JWTClaimsSet>>	doGenerateJWT(JWTClaimsSet.Builder<JWTClaimsSet,?> jwtClaimsSetBuilder)	Generates the JWT from the prefilled JWT claims set builder.
protected Mono<JWE<JWTClaimsSet>>	doReadJWT(String sessionId)	Reads the JWT session id and returns the corresponding JWT object.
Mono<JWE<JWTClaimsSet>>	generateJWT(JWTSession<A,B> session)	Generates a JWT session identifier for the specified JWT session.
String	getIssuer()	Returns the JWT issuer.
Mono<JWE<JWTClaimsSet>>	readJWT(String sessionId)	Validates and decrypts the specified JWT session identifier.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface io.inverno.mod.session.jwt.JWTSessionIdGenerator

generate

Field Details

jwtService

protected final JWTService jwtService

The JWT service.

issuer

protected final String issuer

The JWT issuer.

Constructor Details

JWTESessionIdGenerator

public JWTESessionIdGenerator(JWTService jwtService,
 Consumer<JWEHeaderConfigurator<?>> headerConfigurer)

Creates a JWE JWT session id generator.

Parameters:

jwtService - the JWT service

headerConfigurer - the JWE header configurer

JWTESessionIdGenerator

public JWTESessionIdGenerator(JWTService jwtService,
 Consumer<JWEHeaderConfigurator<?>> headerConfigurer,
 String issuer)

Creates a JWE JWT session id generator.

Parameters:

jwtService - the JWT service

headerConfigurer - the JWE header configurer

issuer - the issuer

Method Details

getIssuer

public String getIssuer()

Returns the JWT issuer.

Returns:

the issuer

doGenerateJWT

protected Mono<JWE<JWTClaimsSet>> doGenerateJWT(JWTClaimsSet.Builder<JWTClaimsSet,?> jwtClaimsSetBuilder)

Generates the JWT from the prefilled JWT claims set builder.

Parameters:

jwtClaimsSetBuilder - a prefilled JWT claims set builder

Returns:

a mono generating the JWT

doReadJWT

protected Mono<JWE<JWTClaimsSet>> doReadJWT(String sessionId)

Reads the JWT session id and returns the corresponding JWT object.

Parameters:

sessionId - a JWT session id

Returns:

a mono emitting the JWT corresponding object

generateJWT

public Mono<JWE<JWTClaimsSet>> generateJWT(JWTSession<A,B> session)

Description copied from interface: JWTSessionIdGenerator

Generates a JWT session identifier for the specified JWT session.

Implementors should ensure that JWT are generated with unique JWT token identifiers (i.e. JTI) to prevent against replay attack.

Specified by:

generateJWT in interface JWTSessionIdGenerator<A,B>

Parameters:

session - a JWT session

Returns:

a mono generating a JWT

readJWT

public Mono<JWE<JWTClaimsSet>> readJWT(String sessionId)

Description copied from interface: JWTSessionIdGenerator

Validates and decrypts the specified JWT session identifier.

Specified by:

readJWT in interface JWTSessionIdGenerator<A,B>

Parameters:

sessionId - a JWT session identifier

Returns:

a mono reading a JWT session identifier