Spring Security——SessionManagement中InvalidSessionStrategy自定义——简单跳过Fitter过滤刷新Session

电玩女神 2022-10-30 01:29 5阅读 0赞

# 需求分析 #

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzI3Mjc4MQ_size_16_color_FFFFFF_t_70][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzI3Mjc4MQ_size_16_color_FFFFFF_t_70 1][]

# 解决方案 #

创建一个新的Session，并且重定向到原请求地址。

/**
     * @author ShenTuZhiGang
     * @version 1.0.0
     * @date 2021-02-16 21:48
     */
    @Slf4j
    @Component
    public class CustomSimpleIgnoreInvalidSessionStrategy implements InvalidSessionStrategy {
        private boolean createNewSession = true;
    
        @Override
        public void onInvalidSessionDetected(HttpServletRequest request,
                                             HttpServletResponse response) throws IOException, ServletException {
            log.debug("Starting new session (if required), but do not nothing.");
            if (createNewSession) {
                request.getSession();
            }
            RequestDispatcher requestDispatcher = request.getRequestDispatcher(request.getServletPath());
            requestDispatcher.forward(request, response);
        }
    
        public void setCreateNewSession(boolean createNewSession) {
            this.createNewSession = createNewSession;
        }
    }

应用

@Configuration
    public class LoginConfig extends WebSecurityConfigurerAdapter {
        @Autowired
        CustomSimpleIgnoreInvalidSessionStrategy customSimpleIgnoreInvalidSessionStrategy;
        @Override
        protected void configure(HttpSecurity http) throws Exception {
    
            http.authorizeRequests()
    
                    // 设置不需要授权的请求
                    .antMatchers("/js/*", "/login.html").permitAll()
    
                    // 其它任何请求都需要验证权限
                    .anyRequest().authenticated()
    
                    // 设置自定义表单登录页面
                    .and().formLogin().loginPage("/login.html")
    
                    // 设置登录验证请求地址为自定义登录页配置action （"/login/form"）
                    .loginProcessingUrl("/login/form")
    
                    // 设置默认登录成功跳转页面
                    .defaultSuccessUrl("/main.html")
    
                    /* session 管理 */
                    .and().sessionManagement()
    
                    // 设置Session失效跳转页面
                    .invalidSessionUrl("/login.html")
    
                    // 设置最大Session数为1
                    .maximumSessions(1)
    
                    // 设置Session过期处理策略
                    .expiredSessionStrategy(customSimpleIgnoreInvalidSessionStrategy).and()
    
                    // 暂时停用csrf，否则会影响验证
                    .and().csrf().disable();
        }
    
    }

# 参考文章 #

[Spring Security 之Session管理配置][Spring Security _Session]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzI3Mjc4MQ_size_16_color_FFFFFF_t_70]: /images/20221024/aff6f837cc8a43f19565939ed377b1fe.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzI3Mjc4MQ_size_16_color_FFFFFF_t_70 1]: /images/20221024/ab91bb51c7774cde9f4d399531b2f080.png
[Spring Security _Session]: https://www.cnblogs.com/jonban/p/session.html