SessionConfig
Configuration for the session strategy factory.
Builds an AuthenticationStrategy.Sync backed by a SessionAuthenticator and sessionManager. The identity type your session stores is your own — bring your own type; roles come from SessionDetails.roles. When using the default HttpSessionManager, the identity must be java.io.Serializable (rejected at create time). Session create/invalidate is the caller's responsibility — keep a reference to sessionManager and call it from your login/logout handlers.
Properties
Renders 403 responses for authenticated callers denied by authorization. Defaults to a bare 403.
The SessionManager backing the built SessionAuthenticator.
Renders 401 responses for failed or absent authentication. Defaults to UnauthorizedHandler.DEFAULT (bare HTTP 401).