java.lang.Object
net.i2p.servlet.filters.SessionManager
public class SessionManagerextends Object
Simple session manager for console authentication. Stores sessions in memory with expiration.

  • Field Details

    • _log

      private static final Log _log
      Logger for the console sessions.

    • SESSION_TIMEOUT_MS

      private static final int SESSION_TIMEOUT_MS
      Time an idle session stays valid.
      See Also:

    • CLEANUP_INTERVAL_MS

      private static final int CLEANUP_INTERVAL_MS
      Interval between cleanup runs.
      See Also:

    • INSTANCE

      private static final SessionManager INSTANCE
      The single instance of the filter.

    • RANDOM

      private static final SecureRandom RANDOM
      Random source for the session tokens.

    • _sessions

      private final Map<String, SessionManager.Session> _sessions
      The active sessions, by token.

    • _failedLogins

      private final Map<String, SessionManager.FailedLogin> _failedLogins
      Failed logins, by user name.

    • _cleanup

      private final ScheduledExecutorService _cleanup
      Scheduler for the cleanup jobs.

    • MAX_FAILED_ATTEMPTS

      private static final int MAX_FAILED_ATTEMPTS
      Failed logins before a lockout.
      See Also:

    • FAILURE_WINDOW_MS

      private static final long FAILURE_WINDOW_MS
      Window the failed logins count in.
      See Also:

    • SESSION_ATTR_USER

      public static final String SESSION_ATTR_USER
      Session attribute under which the console stores the logged-in username.
      See Also:

  • Constructor Details

    • SessionManager

      private SessionManager()
      Builds the singleton and starts the cleanup.

  • Method Details

    • getInstance

      public static SessionManager getInstance()
      Returns the single session manager, creating it on first use.
      Returns:
      the singleton instance holding the live session table

    • createSession

      public String createSession(String username)
      Create a new session for a user with default 30 min expiry.
      Parameters:
      username - the user the session is issued to, returned by validateSession(String)
      Returns:
      the 64-character hex session token to hand to the client

    • createSession

      public String createSession(String username, long expiryMs)
      Create a new session for a user with custom expiry.
      Parameters:
      username - the user the session is issued to, returned by validateSession()
      expiryMs - expiry time in milliseconds, or -1 for no expiry (forever)
      Returns:
      the 64-character hex session token to hand to the client

    • validateSession

      public String validateSession(String token)
      Validate a session token.
      Parameters:
      token - the token to look up; null is treated as invalid
      Returns:
      username if valid, null if invalid/expired

    • restoreSession

      public void restoreSession(String token, String username, long expiresAt)
      Restore a persisted session with its original token. Used on router restart to maintain login sessions.
      Parameters:
      token - the original session token from persistence
      username - the user the restored session belongs to, returned by validateSession()
      expiresAt - absolute expiry time, or -1 for no expiry

    • invalidateSession

      public void invalidateSession(String token)
      Drops a session token, so validateSession() stops accepting it.
      Parameters:
      token - the token to drop from the session table; null is ignored

    • generateToken

      private String generateToken()
      Generates a random session token.
      Returns:
      the token, base64

    • cleanupExpiredSessions

      private void cleanupExpiredSessions()
      Removes the sessions past their expiry.

    • shutdown

      public void shutdown()
      Stops the cleanup scheduler, ending periodic session expiry.

    • recordFailedLogin

      public void recordFailedLogin(String ip)
      Record a failed login attempt from an IP address.
      Parameters:
      ip - the client address the attempt came from, used as the counter key

    • isBlocked

      public boolean isBlocked(String ip)
      Check if IP is blocked due to too many failed attempts.
      Parameters:
      ip - the client address to test against the recent-failure counters
      Returns:
      true if blocked

    • clearFailedLogins

      public void clearFailedLogins(String ip)
      Clear failed login attempts for an IP after successful login.
      Parameters:
      ip - the client address whose failure counter is discarded

    • cleanupFailedLogins

      private void cleanupFailedLogins()
      Drops the failed logins outside the window.