Package ratpack.session
Interface SessionTypeFilter
-
- All Known Subinterfaces:
SessionTypeFilterPlugin
public interface SessionTypeFilterA filter that determines whether a type is safe for session usage.Most applications should not need to use or implement this interface. By default, an implementation is used that allows:
- Typical data types from
java.langandjava.util NotSerializableExceptionand its super types- types registered with
SessionModule.allowTypes(com.google.inject.Binder, java.lang.Class<?>...) - types allowed by any multi-bound
SessionTypeFilterPluginimplementations
- Since:
- 1.9
-
-
Method Summary
All Methods Static Methods Instance Methods Abstract Methods Default Methods Deprecated Methods Modifier and Type Method Description booleanallow(java.lang.String className)Indicates whether the given type is allowed to be stored or loaded from session data.default voidassertAllowed(java.lang.String className)ThrowsNonAllowedSessionTypeExceptionif the given type is not allowed by this filterer.static SessionTypeFilterunsafeAllowAll()Deprecated.since 1.9
-
-
-
Method Detail
-
allow
boolean allow(java.lang.String className)
Indicates whether the given type is allowed to be stored or loaded from session data.- Parameters:
className- the name of a class to check- Returns:
- whether or the not type can be used
-
assertAllowed
default void assertAllowed(java.lang.String className) throws NonAllowedSessionTypeExceptionThrowsNonAllowedSessionTypeExceptionif the given type is not allowed by this filterer.This method is typically called by
SessionSerializerimplementations before serializing or deserializing a type. It does not need to be overridden by implementations of this type.- Parameters:
className- the class name to the assert- Throws:
NonAllowedSessionTypeException
-
unsafeAllowAll
@Deprecated static SessionTypeFilter unsafeAllowAll()
Deprecated.since 1.9An unsafe implementation that allows all types.This implementation is unsafe in that it allows “gadget attacks” if session payloads can be forged. It should only be used as a temporary measure.
- Returns:
- a session type filter that allows all types.
- Since:
- 1.9
- See Also:
SessionModule.allowTypes(com.google.inject.Binder, java.lang.Class<?>...)
-
-