Spring-security源码-Filter之SessionManagementFilter(十六)

对Session控制和管理

配置

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .anyRequest()
                .authenticated()
                .and().rememberMe()//记住登录
                .tokenRepository(new InMemoryTokenRepositoryImpl())
                .and()
                .formLogin()// rm表单的方式
                .loginPage("/login")//登录页面路径
                .loginProcessingUrl("/doLogin")
                //自定义登录请求地址
                .defaultSuccessUrl("/hello")
                .usernameParameter("loginName")
                .passwordParameter("loginPassword")
                .permitAll(true)//不拦截
                .and()
                .csrf()//记得关闭
                .disable()
                .sessionManagement().
                 maximumSessions(1) //需要这个字段设置为1
                .maxSessionsPreventsLogin(true);
    }

初始化处

org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer#configure

 public void configure(H http) {
        //SecurityContextRepository 可以参考默认是吸纳
        SecurityContextRepository securityContextRepository = http.getSharedObject(SecurityContextRepository.class);
        //getSessionAuthenticationStrategy 为Session的管理 可以参考实现 比如只允许一个用户在线的控制
        SessionManagementFilter sessionManagementFilter = new SessionManagementFilter(securityContextRepository,
                getSessionAuthenticationStrategy(http));
        //如果配置了出现异常 跳转的url则默认handle为SimpleUrlAuthenticationFailureHandler 底层控制异常跳转指定url
        if (this.sessionAuthenticationErrorUrl != null) {
            sessionManagementFilter.setAuthenticationFailureHandler(
                    new SimpleUrlAuthenticationFailureHandler(this.sessionAuthenticationErrorUrl));
        }
        
        InvalidSessionStrategy strategy = getInvalidSessionStrategy();
        if (strategy != null) {
            sessionManagementFilter.setInvalidSessionStrategy(strategy);
        }
        //异常的回调处理器
        AuthenticationFailureHandler failureHandler = getSessionAuthenticationFailureHandler();
        if (failureHandler != null) {
            sessionManagementFilter.setAuthenticationFailureHandler(failureHandler);
        }
        //校验当前会话是否可以处理 可以看一下默认实现
        AuthenticationTrustResolver trustResolver = http.getSharedObject(AuthenticationTrustResolver.class);
        if (trustResolver != null) {
            sessionManagementFilter.setTrustResolver(trustResolver);
        }
        //Autowried注入
        sessionManagementFilter = postProcess(sessionManagementFilter);
        http.addFilter(sessionManagementFilter);
        //如果return this.maximumSessions != null;
        if (isConcurrentSessionControlEnabled()) {
            ConcurrentSessionFilter concurrentSessionFilter = createConcurrencyFilter(http);

            concurrentSessionFilter = postProcess(concurrentSessionFilter);
            http.addFilter(concurrentSessionFilter);
        }
    }

org.springframework.security.web.session.SessionManagementFilter#doFilter(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, javax.servlet.FilterChain)

    private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        //避免重复执行
        if (request.getAttribute(FILTER_APPLIED) != null) {
            chain.doFilter(request, response);
            return;
        }
        request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
        //判断是否存在Context 多个实现 比如参考HttpSessionSecurityContextRepository<1>
        if (!this.securityContextRepository.containsContext(request)) {
            Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
            //判断authentication 是否可以处理
            if (authentication != null && !this.trustResolver.isAnonymous(authentication)) {
                // The user has been authenticated during the current request, so call the
                // session strategy
                try {
                    //进行Session的校验 比如是否超过最大限制 多个实现 可以参考各个是实现<2>
                    this.sessionAuthenticationStrategy.onAuthentication(authentication, request, response);
                }
                catch (SessionAuthenticationException ex) {
                    // The session strategy can reject the authentication
                    this.logger.debug("SessionAuthenticationStrategy rejected the authentication object", ex);
                    //清空
                    SecurityContextHolder.clearContext();
                    //回调自定义error处理器
                    this.failureHandler.onAuthenticationFailure(request, response, ex);
                    return;
                }
                //认证通过保存context
                this.securityContextRepository.saveContext(SecurityContextHolder.getContext(), request, response);
            }
            else {
                // No security context or authentication present. Check for a session
                // timeout
                if (request.getRequestedSessionId() != null && !request.isRequestedSessionIdValid()) {
                    if (this.logger.isDebugEnabled()) {
                        this.logger.debug(LogMessage.format("Request requested invalid session id %s",
                                request.getRequestedSessionId()));
                    }
                    if (this.invalidSessionStrategy != null) {
                        this.invalidSessionStrategy.onInvalidSessionDetected(request, response);
                        return;
                    }
                }
            }
        }
        chain.doFilter(request, response);
    }

<1>

org.springframework.security.web.context.HttpSessionSecurityContextRepository#containsContext

初始化处 可参考：https://www.cnblogs.com/LQBlog/p/15529767.html#autoid-0-0-0

    @Override
    public boolean containsContext(HttpServletRequest request) {
        HttpSession session = request.getSession(false);
        if (session == null) {
            return false;
        }
        return session.getAttribute(this.springSecurityContextKey) != null;
    }

<2>

com.biz.soa.order.service.oms.push.builder.omssend.Director#onAuthentication

 public void onAuthentication(Authentication authentication, HttpServletRequest request,
                                 HttpServletResponse response) {
        //最大允许session会话数量
        int allowedSessions = getMaximumSessionsForThisUser(authentication);
        if (allowedSessions == -1) {
            // We permit unlimited logins
            return;
        }
        //根据用户登录名字 查询当前所有会话
        List<SessionInformation> sessions = this.sessionRegistry.getAllSessions(authentication.getPrincipal(), false);
        int sessionCount = sessions.size();
        if (sessionCount < allowedSessions) {
            // They haven't got too many login sessions running at present
            return;
        }
        //如果超过
        if (sessionCount == allowedSessions) {
            HttpSession session = request.getSession(false);
            // 将自己之前的会话都清除
            if (session != null) {
                for (SessionInformation si : sessions) {
                    if (si.getSessionId().equals(session.getId())) {
                        return;
                    }
                }
            }
        }
        //<3>清除会话
        allowableSessionsExceeded(sessions, allowedSessions, this.sessionRegistry);
    }

<3>

org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy#allowableSessionsExceeded

    protected void allowableSessionsExceeded(List<SessionInformation> sessions, int allowableSessions,
                                             SessionRegistry registry) throws SessionAuthenticationException {
        //这里应该exceptionIfMaximumExceeded 配置了这个是限制登录不超过
        if (this.exceptionIfMaximumExceeded || (sessions == null)) {
            throw new SessionAuthenticationException(
                    this.messages.getMessage("ConcurrentSessionControlAuthenticationStrategy.exceededAllowed",
                            new Object[] { allowableSessions }, "Maximum sessions of {0} for this principal exceeded"));
        }
        // 这里应该是将其他用户挤出去
        sessions.sort(Comparator.comparing(SessionInformation::getLastRequest));
        int maximumSessionsExceededBy = sessions.size() - allowableSessions + 1;
        List<SessionInformation> sessionsToBeExpired = sessions.subList(0, maximumSessionsExceededBy);
        for (SessionInformation session : sessionsToBeExpired) {
            //设置session 过期后续再这个filter就会被自动踢出去<跳转>
            session.expireNow();
        }
    }