Major Description
So, I've run into a bit of a pickle with DefaultWebSecurityManager and
native vs http sessions.
The DefaultWebSecurityManager exposes two methods, ostensibly for the
purposes of determining how sessions are managed:
setSessionManager(SessionManager)
and
setSessionMode(String)
However, it would appear that if I call:
setSessionManager(new MyCustomSessionManager())
and then
setSessionMode("native")
the SessionManager is overridden.
This is a bit of a gotcha, but can be easily avoided by not calling
setSessionMode. (calling them in the reverse order seems contrary to
the nature of setters) The problem with not calling setSessionMode is
that it appears to actually matter - if I leave it to it's default
(http), but set a DefaultWebSessionManager, then things break horribly
(apparently due to the use of isHttpSessionMode by AbstractShiroFilter
for redirect rewriting). Sessions get forgotten, etc. This also seems
contrary to the nature of setters.