Interface SessionPolicy<U>

Type Parameters:

U - the application's subject type

All Known Implementing Classes:

NoopSessionPolicy, TimeoutSessionPolicy

public interface SessionPolicy<U>

Pluggable session policy.

The expected call sequence inside a Vaadin or REST adapter:

1. onLogin(SessionContext) — after a successful login. Implementations may emit SESSION_CREATED audit events and signal "rotate session id now" via the return value.
2. beforeNavigation(SessionContext) — before each protected navigation (Vaadin: every BeforeEnterEvent on a restricted target; REST: every authenticated request). The returned SessionDecision drives whether the navigation continues, requires re-authentication, or invalidates the session.
3. onLogout(SessionContext) — when the subject explicitly logs out. Implementations may emit SESSION_INVALIDATED audit events.

The default implementation NoopSessionPolicy returns SessionDecision.Continue.INSTANCE for every event. The provided TimeoutSessionPolicy adds idle / absolute timeouts and optional session-id rotation.

Method Summary

Modifier and Type	Method	Description
SessionDecision	beforeNavigation(SessionContext<U> context)	Called before each protected navigation.
default SessionPolicyDecision	evaluate(SessionMetadata metadata)	Pure-query lifetime check used by the Vaadin SessionLifetimeListener and the REST authentication / authorization filters.
default SessionDecision	onLogin(SessionContext<U> context)	Called after a successful login.
default void	onLogout(SessionContext<U> context)	Called when the subject explicitly logs out.

Method Details

onLogin

default SessionDecision onLogin(SessionContext<U> context)

Called after a successful login.

The default returns SessionDecision.Continue.INSTANCE. Implementations that want to rotate the session id after login should return SessionDecision.Invalidate with a target route — the adapter then closes the old session and the next request creates a fresh one.

Parameters:

context - session view at the moment of login

Returns:

decision for the post-login navigation

beforeNavigation

SessionDecision beforeNavigation(SessionContext<U> context)

Called before each protected navigation. The implementation typically checks idle and absolute timeouts here and returns SessionDecision.RequireLogin or SessionDecision.Invalidate when a threshold has been exceeded.

Parameters:

context - current session view

Returns:

decision for the navigation

onLogout

default void onLogout(SessionContext<U> context)

Called when the subject explicitly logs out.

The default is a no-op; implementations that emit audit events for logout should override or delegate.

Parameters:

context - session view at the moment of logout

evaluate

default SessionPolicyDecision evaluate(SessionMetadata metadata)

Pure-query lifetime check used by the Vaadin SessionLifetimeListener and the REST authentication / authorization filters.

Distinct from beforeNavigation(SessionContext) in two ways:

• Input is the minimal SessionMetadata record — subjectId, createdAt, lastActivityAt. No subject reference, no attribute bag, no client address.
• Output is the minimal SessionPolicyDecision sealed type — Active, IdleTimeout, or AbsoluteLifetimeExceeded. The adapter decides what to do with each (Vaadin reroute, REST 401, …).

The default returns SessionPolicyDecision.active() so policies that only care about the lifecycle hooks remain valid. Implementations with timeout logic — TimeoutSessionPolicy — override this method.

Parameters:

metadata - current session view

Returns:

decision; never null