spring-security使用-session共享(六)
session共享的几种方案
方案一
不放在服务器应用中管理，放在第三方统一管理，如redis,数据库等,现在主流都是放在redis 因为redis高效qps最高能达到10万+
方案二
session 拷贝,集群情况某一台服务器session发生改变，通知其他服务器,这样会有个问题，如果集群实例太多，要通知太多的服务器，而且原子性也需要保证(所有服务要么一起成功要么一起失败)
方案三
粘滞会话,我第一家公司就是这样处理,根据用户id nginx都路由到一个实例
自定义
使用spring自带的实现
通过SpringSessionBackedSessionRegistry 通过关键字百度搜搜很多方案
自定义SessionRegistory
可以参考默认的org.springframework.security.core.session.SessionRegistryImpl 因为是基于应用的 sessionCRUD都是操作应用内数据结构我们
1.接口定义
public interface SessionRegistry { //获得所有会话sessionId List<Object> getAllPrincipals(); //获得指定用户的会话列表 List<SessionInformation> getAllSessions(Object userId, boolean var2); //获得指定sessionId的会话 SessionInformation getSessionInformation(String sessionId); //刷新访问时间 void refreshLastRequest(String var1); //注册会话 void registerNewSession(String sessionId, Object var2); //删除会话 void removeSessionInformation(String var1); }
2.实现
public class RedisSessionRegistryImpl implements SessionRegistry, ApplicationListener<SessionDestroyedEvent> { private RedisTemplate redisTemplate; //维护所有sessionId列表的zset score为过期时间 private final static String SESSION_LIST_KEY = "session:list"; //维护指定用户sessionId列表的zset score为过期时间 private final static String SESSION_USER_LIST_KEY = "session:list:userId:%s"; //存储sessionId对应的数据 private final static String SESSION_ITEM_KEY = "session:item:%s"; public RedisSessionRegistryImpl(RedisTemplate redisTemplate) { this.redisTemplate = redisTemplate; } @Override public void onApplicationEvent(SessionDestroyedEvent sessionDestroyedEvent) { String sessionId = sessionDestroyedEvent.getId(); this.removeSessionInformation(sessionId); } /** * 获得所有会话 * * @return */ @Override public List<Object> getAllPrincipals() { Set<Object> sessionIds = redisTemplate.boundZSetOps(SESSION_LIST_KEY).range(0, -1); if (CollectionUtils.isEmpty(sessionIds)) { return null; } return sessionIds.stream().collect(Collectors.toList()); } /** * 获得指定用户列表的会话 * * @param includeExpiredSessions * @return */ @Override public List<SessionInformation> getAllSessions(Object userId, boolean includeExpiredSessions) { Set<String> sessionsUsedByPrincipal = redisTemplate.boundZSetOps(String.format(SESSION_USER_LIST_KEY, userId)).range(0, -1); if (sessionsUsedByPrincipal == null) { return Collections.emptyList(); } else { List<SessionInformation> list = new ArrayList(sessionsUsedByPrincipal.size()); Iterator var5 = sessionsUsedByPrincipal.iterator(); while (true) { SessionInformation sessionInformation; do { do { if (!var5.hasNext()) { return list; } String sessionId = (String) var5.next(); sessionInformation = this.getSessionInformation(sessionId); } while (sessionInformation == null); } while (!includeExpiredSessions && sessionInformation.isExpired()); list.add(sessionInformation); } } } /** * 根据sessionId获得会话 * * @param sessionId * @return */ @Override public SessionInformation getSessionInformation(String sessionId) { Object jsonValue = redisTemplate.opsForValue().get(String.format(SESSION_ITEM_KEY, sessionId)); if (StringUtils.isEmpty(jsonValue)) { return null; } JSONObject jsonObject= JSON.parseObject(jsonValue.toString()); SessionInformation sessionInformation=new SessionInformation(JSON.parseObject(jsonObject.getString("principal"), UserInfoDto.class),jsonObject.getString("sessionId"),jsonObject.getDate("lastRequest")); if(jsonObject.getBoolean("expired")){ sessionInformation.expireNow(); } return sessionInformation; } /** * 刷新session过期时间 * * @param sessionId */ @Override public void refreshLastRequest(String sessionId) { SessionInformation info = this.getSessionInformation(sessionId); if (info != null) { info.refreshLastRequest(); } registerNewSession(sessionId, info); } /** * 注册session * * @param sessionId * @param principal */ @Override public void registerNewSession(String sessionId, Object principal) { SessionInformation sessionInformation =new SessionInformation(principal, sessionId, new Date()); redisTemplate.opsForValue().set(String.format(SESSION_ITEM_KEY, sessionId), JSON.toJSONString(sessionInformation)); redisTemplate.boundZSetOps(SESSION_LIST_KEY).add(sessionId, System.currentTimeMillis() + 30000); String username; //因为第一次传入的是username 登录成功传入的是我们的UserDetails对象 if(principal instanceof UserDetails){ username=((UserDetails)principal).getUsername(); }else{ username=principal.toString(); } redisTemplate.boundZSetOps(String.format(SESSION_ITEM_KEY, username)).add(sessionId, System.currentTimeMillis() + 30000); } /** * 从会话中移除 * * @param sessionId */ @Override public void removeSessionInformation(String sessionId) { SessionInformation sessionInformation = getSessionInformation(sessionId); redisTemplate.delete(String.format(SESSION_ITEM_KEY, sessionId)); redisTemplate.boundZSetOps(SESSION_LIST_KEY).add(sessionId, System.currentTimeMillis() + 30000); if (sessionInformation != null) { redisTemplate.boundZSetOps(String.format(SESSION_ITEM_KEY, sessionInformation.getPrincipal())).add(sessionId, System.currentTimeMillis() + 30000); } } }
3.替换
@Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests() .anyRequest().authenticated() .and() .rememberMe() .key("system") .and() .formLogin() .authenticationDetailsSource(new MyWebAuthenticationDetailsSource()) .usernameParameter("loginName") .passwordParameter("loginPassword") .defaultSuccessUrl("/hello") .failureForwardUrl("/loginFail") .failureUrl("/login.html") .permitAll()//不拦截 .and() .csrf()//记得关闭 .disable() .sessionManagement() .maximumSessions(1) .maxSessionsPreventsLogin(true) .sessionRegistry(new RedisSessionRegistryImpl(redisTemplate)); }
源码
回头看《spring-security使用-同一个账号只允许登录一次(五)》的源码
1.org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy#onAuthentication
public void onAuthentication(Authentication authentication, HttpServletRequest request, HttpServletResponse response) throws SessionAuthenticationException { SessionAuthenticationStrategy delegate; //遍历delegateStrategies 调用onAuthentication方法 for(Iterator var4 = this.delegateStrategies.iterator(); var4.hasNext(); delegate.onAuthentication(authentication, request, response)) { delegate = (SessionAuthenticationStrategy)var4.next(); if (this.logger.isDebugEnabled()) { this.logger.debug("Delegating to " + delegate); } } }
2.org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy#onAuthentication
public class RegisterSessionAuthenticationStrategy implements SessionAuthenticationStrategy { private final SessionRegistry sessionRegistry; public RegisterSessionAuthenticationStrategy(SessionRegistry sessionRegistry) { Assert.notNull(sessionRegistry, "The sessionRegistry cannot be null"); this.sessionRegistry = sessionRegistry; } public void onAuthentication(Authentication authentication, HttpServletRequest request, HttpServletResponse response) { this.sessionRegistry.registerNewSession(request.getSession().getId(), authentication.getPrincipal()); } }
