javawebparts.filter
Class SessionLimiterFilter

java.lang.Object
  |
  +--javawebparts.filter.SessionLimiterFilter

All Implemented Interfaces:

javax.servlet.Filter

public class SessionLimiterFilter

extends java.lang.Object

implements javax.servlet.Filter

This filter can be used to limit the number of concurrent sessions allowed by a webapp at any given time.

You have to specify the number of allowed sessions and a page where you want to forward requests that would exceed the limit.

Important!
In order to use the session limiting facility you will also have to configure the listener javawebparts.listener.SessionLimiterListener in your web.xml.

Init parameters are:

• maxSessions - A positive integer representing the number of sessions allowed at the same time. Required: Yes. Default: N/A.



• forwardTo - This is the page where the request will be forwarded if the number of concurrent sessions has been already reached, so access is not allowed. Required: Yes.



• filterExpired - If set to true (the default), requests that contain expired session IDs will be forwarded to the forwardTo page. If set to false, the request is allowed through. You would normaly set it to false if another filter (that will fire after this filter) handles expired sessions. Required: No. Default: true.



• pathSpec - Either "include" or "exclude". This determines whether the list of paths in the pathList parameter is a list of paths to include in filter functionality, or a list of paths to exclude. Required: No. Default: None.



• pathList - This is a comma-separated list of paths, which can use asterisk for wildcard support, that denotes either paths to include or exclude from the functioning of this filter (depending on what pathSpec is set to). The paths ARE case-senitive! There is no limit to how many items can be specified, although for performance reasons a developer will probably want to specify as few as possible to get the job done (each requested path is matched via regex). Note also that you are of course still required to specify a path for the filter itself as per the servlet spec. This parameter however, together with pathSpec, gives you more control and flexibility than that setting alone. Required: No. Default: None.
  
  General note on pathSpec and pathList: If pathSpec is not specified but pathList IS, then 'exclude' is assumed for pathSpec. If pathSpec is specified by pathList IS NOT, then the filter WILL NEVER EXECUTE (this is technically a misconfiguration). If NEITHER is defined then the generic filter mapping will be in effect only.

Example configuration in web.xml:

<filter>
<filter-name>SessionLimiterFilter< /filter-name>
<filter-class>javawebparts.filter.SessionLimiterFilter< /filter-class>
<init-param>
<param-name>maxSessions</param-name>
<param-value>1</param-value>
</init-param>
<init-param>
<param-name>forwardTo</param-name>
<param-value>/SLFTooMany.jsp.jpg,< /param-value>
</init-param>
<init-param>
<param-name>pathSpec</param-name>
<param-value>exclude</param-value>
</init-param>
<init-param>
<param-name>pathList</param-name>
<param-value>/img/header1.gif< /param-value>
</init-param>
</filter>

<filter-mapping>
<filter-name>SessionLimiterFilter< /filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

Author:

Tamas Szabo

Field Summary

private javax.servlet.ServletContext	ctx The ServletContext of the filter.
private boolean	filterExpired Filter request with expired session ID.
private java.lang.String	forwardTo A path to forward to when access is denied.
private static org.apache.commons.logging.Log	log Log instance.
private int	maxSessions The number of session allowed.
private java.util.ArrayList	pathList List of paths for filter functionality determination.
private java.lang.String	pathSpec Whether pathList includes or excludes.

Constructor Summary

SessionLimiterFilter()

Method Summary

void	destroy() Destroy.
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain filterChain) Do filter's work.
void	init(javax.servlet.FilterConfig filterConfig) Initialize this filter.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

log

private static org.apache.commons.logging.Log log

Log instance.

forwardTo

private java.lang.String forwardTo

A path to forward to when access is denied.

ctx

private javax.servlet.ServletContext ctx

The ServletContext of the filter.

pathSpec

private java.lang.String pathSpec

Whether pathList includes or excludes.

pathList

private java.util.ArrayList pathList

List of paths for filter functionality determination.

maxSessions

private int maxSessions

The number of session allowed.

filterExpired

private boolean filterExpired

Filter request with expired session ID.

Constructor Detail

SessionLimiterFilter

public SessionLimiterFilter()

Method Detail

destroy

public void destroy()

Destroy.

Specified by:

destroy in interface javax.servlet.Filter

init

public void init(javax.servlet.FilterConfig filterConfig)
          throws javax.servlet.ServletException

Initialize this filter.

Specified by:

init in interface javax.servlet.Filter

Parameters:

filterConfig - The configuration information for this filter.

Throws:

javax.servlet.ServletException - ServletException.

doFilter

public void doFilter(javax.servlet.ServletRequest request,
                     javax.servlet.ServletResponse response,
                     javax.servlet.FilterChain filterChain)
              throws javax.servlet.ServletException,
                     java.io.IOException

Do filter's work.

Specified by:

doFilter in interface javax.servlet.Filter

Parameters:

request - The current request object.

response - The current response object.

filterChain - The current filter chain.

Throws:

javax.servlet.ServletException - ServletException.

java.io.IOException - IOException.