Spring Security（九）会话并发控制->监听注销

- 日理万妓 2023-06-06 10:59 1阅读 0赞

在上一文章中，我们尝试将已经登录的旧会话注销（通常访问/logout），理论上应该可以继续登录了，但实际上Spring Security依然提示我们超过了最大会话数。事实上，除非重启服务，否则该用户将很难再次登录系统。这是因为Spring Security是通过监听session的销毁事件来触发会话信息表相关清理工作的，但我们并没有注册过相关的监听器，导致Spring Security无法正常清理过期或已注销的会话。

在Servlet中，监听session相关事件的方法是实现HttpSessionListener接口，并在系统中注册该监听器。Spring Security在HttpSessionEventPublisher类中实现HttpSessionEventPublisher接口，并转换为Spring的事件机制。

HttpSessionEventPublisher主要代码如下：

public class HttpSessionEventPublisher implements HttpSessionListener {
    	// ~ Static fields/initializers
    	// =====================================================================================
    
    	private static final String LOGGER_NAME = HttpSessionEventPublisher.class.getName();
    
    	// ~ Methods
    	// ========================================================================================================
    
    	ApplicationContext getContext(ServletContext servletContext) {
    		return SecurityWebApplicationContextUtils.findRequiredWebApplicationContext(servletContext);
    	}
    
    	/**
    	 * Handles the HttpSessionEvent by publishing a {@link HttpSessionCreatedEvent} to the
    	 * application appContext.
    	 *
    	 * @param event HttpSessionEvent passed in by the container
    	 */
    	public void sessionCreated(HttpSessionEvent event) {
    		HttpSessionCreatedEvent e = new HttpSessionCreatedEvent(event.getSession());
    		Log log = LogFactory.getLog(LOGGER_NAME);
    
    		if (log.isDebugEnabled()) {
    			log.debug("Publishing event: " + e);
    		}
    // 发布session创建事件
    		getContext(event.getSession().getServletContext()).publishEvent(e);
    	}
    
    	/**
    	 * Handles the HttpSessionEvent by publishing a {@link HttpSessionDestroyedEvent} to
    	 * the application appContext.
    	 *
    	 * @param event The HttpSessionEvent pass in by the container
    	 */
    	public void sessionDestroyed(HttpSessionEvent event) {
    		HttpSessionDestroyedEvent e = new HttpSessionDestroyedEvent(event.getSession());
    		Log log = LogFactory.getLog(LOGGER_NAME);
    
    		if (log.isDebugEnabled()) {
    			log.debug("Publishing event: " + e);
    		}
    
    // 发布session销毁事件
    		getContext(event.getSession().getServletContext()).publishEvent(e);
    	}
    }

**解决方法：**

把HttpSessionEventPublisher注册到IOC容器中

@Bean
        public HttpSessionEventPublisher httpSessionEventPublisher(){
            return new HttpSessionEventPublisher();
        }

相关代码：[https://github.com/o99o/SpringSecurity/tree/master/SpringSecurity\_8\_Session][https_github.com_o99o_SpringSecurity_tree_master_SpringSecurity_8_Session]

[https_github.com_o99o_SpringSecurity_tree_master_SpringSecurity_8_Session]: https://github.com/o99o/SpringSecurity/tree/master/SpringSecurity_8_Session