SpringBoot的Session併發控制

時間 2019-11-17

原文原文鏈接

⒈是什麼？html

　　即控制業務系統中一個用戶只能有一個Sessionjava

⒉解決方案web

　　1.當這個用戶在其它地方登陸的時候，把以前的Session失效掉。spring

 1 package cn.coreqi.security.config;
 2 
 3 import cn.coreqi.security.Filter.SmsCodeFilter;
 4 import cn.coreqi.security.Filter.ValidateCodeFilter;
 5 import cn.coreqi.security.session.CoreqiExpiredSessionStrategy;
 6 import org.springframework.beans.factory.annotation.Autowired;
 7 import org.springframework.context.annotation.Bean;
 8 import org.springframework.context.annotation.Configuration;
 9 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
10 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
11 import org.springframework.security.crypto.password.NoOpPasswordEncoder;
12 import org.springframework.security.crypto.password.PasswordEncoder;
13 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
14 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
15 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
16 
17 @Configuration
18 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
19 
20     @Autowired
21     private AuthenticationSuccessHandler coreqiAuthenticationSuccessHandler;
22 
23     @Autowired
24     private AuthenticationFailureHandler coreqiAuthenticationFailureHandler;
25 
26     @Autowired
27     private SmsCodeAuthenticationSecurityConfig smsCodeAuthenticationSecurityConfig;
28 
29     @Bean
30     public PasswordEncoder passwordEncoder(){
31         return NoOpPasswordEncoder.getInstance();
32     }
33 
34 
35     @Override
36     protected void configure(HttpSecurity http) throws Exception {
37         ValidateCodeFilter validateCodeFilter = new ValidateCodeFilter();
38         validateCodeFilter.setAuthenticationFailureHandler(coreqiAuthenticationFailureHandler);
39 
40         SmsCodeFilter smsCodeFilter = new SmsCodeFilter();
41 
42 
43         //http.httpBasic()    //httpBasic登陸 BasicAuthenticationFilter
44         http.addFilterBefore(smsCodeFilter, UsernamePasswordAuthenticationFilter.class)    //加載用戶名密碼過濾器的前面
45                 .addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class)    //加載用戶名密碼過濾器的前面
46                 .formLogin()    //表單登陸 UsernamePasswordAuthenticationFilter
47                     .loginPage("/coreqi-signIn.html")  //指定登陸頁面
48                     //.loginPage("/authentication/require")
49                     .loginProcessingUrl("/authentication/form") //指定表單提交的地址用於替換UsernamePasswordAuthenticationFilter默認的提交地址
50                     .successHandler(coreqiAuthenticationSuccessHandler) //登陸成功之後要用咱們自定義的登陸成功處理器，不用Spring默認的。
51                     .failureHandler(coreqiAuthenticationFailureHandler) //本身體會把
52                 .and()
53                 .sessionManagement()
54                     .invalidSessionUrl("session/invalid")    //session過時後跳轉的URL
55                     .maximumSessions(1) //配置最大的Session數量，即同一個用戶後面登陸所產生的Session以前登陸所產生的Session給失效掉
56                     .expiredSessionStrategy(new CoreqiExpiredSessionStrategy())
57                 .and()
58                 .and()
59                 .authorizeRequests()    //對受權請求進行配置
60                     .antMatchers("/coreqi-signIn.html","/code/image","/session/invalid").permitAll() //指定登陸頁面不須要身份認證
61                     .anyRequest().authenticated()  //任何請求都須要身份認證
62                     .and().csrf().disable()    //禁用CSRF
63                 .apply(smsCodeAuthenticationSecurityConfig);
64             //FilterSecurityInterceptor 整個SpringSecurity過濾器鏈的最後一環
65     }
66 }

 1 package cn.coreqi.security.session;
 2 
 3 import org.springframework.security.web.session.SessionInformationExpiredEvent;
 4 import org.springframework.security.web.session.SessionInformationExpiredStrategy;
 5 
 6 import javax.servlet.ServletException;
 7 import java.io.IOException;
 8 
 9 public class CoreqiExpiredSessionStrategy implements SessionInformationExpiredStrategy {
10     @Override
11     public void onExpiredSessionDetected(SessionInformationExpiredEvent sessionInformationExpiredEvent) throws IOException, ServletException {
12         sessionInformationExpiredEvent.getResponse().setContentType("application/json;charset=UTF-8");
13         sessionInformationExpiredEvent.getResponse().getWriter().write("併發登陸！");
14     }
15 }

　　2.當這個用戶已經登錄了，禁止在其它地方登陸。json

 1 package cn.coreqi.security.config;
 2 
 3 import cn.coreqi.security.Filter.SmsCodeFilter;
 4 import cn.coreqi.security.Filter.ValidateCodeFilter;
 5 import cn.coreqi.security.session.CoreqiExpiredSessionStrategy;
 6 import org.springframework.beans.factory.annotation.Autowired;
 7 import org.springframework.context.annotation.Bean;
 8 import org.springframework.context.annotation.Configuration;
 9 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
10 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
11 import org.springframework.security.crypto.password.NoOpPasswordEncoder;
12 import org.springframework.security.crypto.password.PasswordEncoder;
13 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
14 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
15 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
16 
17 @Configuration
18 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
19 
20     @Autowired
21     private AuthenticationSuccessHandler coreqiAuthenticationSuccessHandler;
22 
23     @Autowired
24     private AuthenticationFailureHandler coreqiAuthenticationFailureHandler;
25 
26     @Autowired
27     private SmsCodeAuthenticationSecurityConfig smsCodeAuthenticationSecurityConfig;
28 
29     @Bean
30     public PasswordEncoder passwordEncoder(){
31         return NoOpPasswordEncoder.getInstance();
32     }
33 
34 
35     @Override
36     protected void configure(HttpSecurity http) throws Exception {
37         ValidateCodeFilter validateCodeFilter = new ValidateCodeFilter();
38         validateCodeFilter.setAuthenticationFailureHandler(coreqiAuthenticationFailureHandler);
39 
40         SmsCodeFilter smsCodeFilter = new SmsCodeFilter();
41 
42 
43         //http.httpBasic()    //httpBasic登陸 BasicAuthenticationFilter
44         http.addFilterBefore(smsCodeFilter, UsernamePasswordAuthenticationFilter.class)    //加載用戶名密碼過濾器的前面
45                 .addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class)    //加載用戶名密碼過濾器的前面
46                 .formLogin()    //表單登陸 UsernamePasswordAuthenticationFilter
47                     .loginPage("/coreqi-signIn.html")  //指定登陸頁面
48                     //.loginPage("/authentication/require")
49                     .loginProcessingUrl("/authentication/form") //指定表單提交的地址用於替換UsernamePasswordAuthenticationFilter默認的提交地址
50                     .successHandler(coreqiAuthenticationSuccessHandler) //登陸成功之後要用咱們自定義的登陸成功處理器，不用Spring默認的。
51                     .failureHandler(coreqiAuthenticationFailureHandler) //本身體會把
52                 .and()
53                 .sessionManagement()
54                     .invalidSessionUrl("session/invalid")    //session過時後跳轉的URL
55                     .maximumSessions(1) //配置最大的Session數量，即同一個用戶後面登陸所產生的Session以前登陸所產生的Session給失效掉
56                     .maxSessionsPreventsLogin(true) //當一個用戶的Session數量達到最大數量之後，阻止後面的登錄行爲
57                 .expiredSessionStrategy(new CoreqiExpiredSessionStrategy())
58                 .and()
59                 .and()
60                 .authorizeRequests()    //對受權請求進行配置
61                     .antMatchers("/coreqi-signIn.html","/code/image","/session/invalid").permitAll() //指定登陸頁面不須要身份認證
62                     .anyRequest().authenticated()  //任何請求都須要身份認證
63                     .and().csrf().disable()    //禁用CSRF
64                 .apply(smsCodeAuthenticationSecurityConfig);
65             //FilterSecurityInterceptor 整個SpringSecurity過濾器鏈的最後一環
66     }
67 }