Details
-
New Feature
-
Status: Closed
-
Normal
-
Resolution: Fixed
-
None
-
None
-
None
-
Platform Sprint 138
Description
This concerrns the HST side of the implementation of CMS-10424.
In addition to using the new CmsContextService and CmsSessionContext to coordinate with the CMS session state,
this will also deprecate the usage of the following org.hippoecm.hst.core.container.ContainerConstants:
- CMS_SSO_REPO_CREDS_ATTR_NAME
- (Boolean) CMS_SSO_AUTHENTICATED
- CMS_USER_ID_ATTR
These session attributes are replaced by the new request attributes (set upon each authorized CMS request):
- CMS_REQUEST_REPO_CREDS_ATTR
- CMS_REQUEST_USER_ID_ATTR
To determine if a HST HttpSession is authorized to process a CMS request, instead of checking the CMS_SSO_AUTHENTICATED session attribute, use:
CmsRequestContext.getContext(HttpSession) != null
The deprecated session attributes are still set to retrain backwards compatibility but no longer used internally.
Attachments
Issue Links
- causes
-
HSTTWO-4042 Remove unused deprecated http session security attributes
- Closed
- is a part of
-
CMS-10424 For CMS Preview and PageComposer use a dedicated CmsSessionContext object to share state with the HST web application(s)
- Closed
- is backported by
-
HSTTWO-3809 [backport 10.2] For CMS Preview and PageComposer use a dedicated CmsSessionContext object to share state with the HST web application(s)
- Closed
-
HSTTWO-3810 [backport 7.9] For CMS Preview and PageComposer use a dedicated CmsSessionContext object to share state with the HST web application(s)
- Closed
- waits for
-
CMS-10425 Support service registration with additional interfaces
- Closed