Package org.apache.juneau.rest.server.auth.oidc.rp

Class SignedCookieSessionStore

java.lang.Object

org.apache.juneau.rest.server.auth.oidc.rp.SignedCookieSessionStore

All Implemented Interfaces:

SessionStore

public class SignedCookieSessionStore
extends Object
implements SessionStore

Stateless SessionStore that serializes the session into an HMAC-signed compact JWT carried entirely in the session cookie. This is the documented default.

Because the session lives client-side, this store scales horizontally and survives server restarts with no shared store. The trade-offs:

• No server-side revocation — supportsServerSideRevocation() is false; a stateless cookie cannot be force-revoked, so this store does NOT support back-channel logout. Use InMemorySessionStore or a caller-supplied distributed store if back-channel logout is required.
• Size cap — cookies are capped (~4 KB); only minimal claims are stored, never the raw access / refresh / ID tokens. An over-cap payload throws rather than silently truncating.
• Key rotation — rotating the signing key invalidates all live sessions (users are bounced to re-login).

The payload is signed with HS256 using the configured signing key (which must be at least 256 bits / 32 bytes). Signature failures, expiry, and parse errors all resolve to Optional.empty() on lookup(String) (fail-closed).

Since:

10.0.0

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	SignedCookieSessionStore.Builder	Builder.

Field Summary

Fields

Modifier and Type	Field	Description
static final int	DEFAULT_MAX_COOKIE_BYTES	Default maximum serialized cookie size in bytes.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	SignedCookieSessionStore(SignedCookieSessionStore.Builder b)	Constructor.

Method Summary

Modifier and Type	Method	Description
static SignedCookieSessionStore.Builder	create()	Static creator.
String	createSessionCookieValue(OidcSession session)	Persists the supplied session and returns the opaque value to set as the session cookie.
void	invalidate(String cookieValue)	Invalidates the session identified by the supplied cookie value.
Optional<OidcSession>	lookup(String cookieValue)	Resolves a session from a cookie value.
boolean	supportsServerSideRevocation()	Returns whether this store can revoke sessions server-side (a prerequisite for back-channel logout).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.juneau.rest.server.auth.oidc.rp.SessionStore

invalidateBySessionId, invalidateBySubject

Field Details

DEFAULT_MAX_COOKIE_BYTES

public static final int DEFAULT_MAX_COOKIE_BYTES

Default maximum serialized cookie size in bytes.

See Also:

• Constant Field Values

Constructor Details

SignedCookieSessionStore

protected SignedCookieSessionStore(SignedCookieSessionStore.Builder b)

Constructor.

Parameters:

b - The builder.

Method Details

create

public static SignedCookieSessionStore.Builder create()

Static creator.

Returns:

A new builder.

createSessionCookieValue

public String createSessionCookieValue(OidcSession session)

Description copied from interface: SessionStore

Persists the supplied session and returns the opaque value to set as the session cookie.

For a server-side store this is typically a random session id used as a lookup key; for a stateless cookie store it is the entire signed session payload.

Specified by:

createSessionCookieValue in interface SessionStore

Parameters:

session - The session to persist. Must not be null.

Returns:

The cookie value the client should send back on subsequent requests. Never null.

lookup

public Optional<OidcSession> lookup(String cookieValue)

Description copied from interface: SessionStore

Resolves a session from a cookie value.

Specified by:

lookup in interface SessionStore

Parameters:

cookieValue - The cookie value previously returned by SessionStore.createSessionCookieValue(org.apache.juneau.rest.server.auth.oidc.rp.OidcSession). Must not be null.

Returns:

The resolved session, or Optional.empty() if absent, expired, invalid, or tampered.

invalidate

public void invalidate(String cookieValue)

Description copied from interface: SessionStore

Invalidates the session identified by the supplied cookie value. No-op if absent.

Specified by:

invalidate in interface SessionStore

Parameters:

cookieValue - The cookie value. Must not be null.

supportsServerSideRevocation

public boolean supportsServerSideRevocation()

Description copied from interface: SessionStore

Returns whether this store can revoke sessions server-side (a prerequisite for back-channel logout).

Defaults to false — stateless cookie stores cannot revoke a session the server never retained.

Specified by:

supportsServerSideRevocation in interface SessionStore

Returns:

true if SessionStore.invalidateBySubject(String) / SessionStore.invalidateBySessionId(String) are supported.