1 #Session超時時間設置，單位是秒，默認是30分鐘 2 server.session.timeout=10
然而並無什麼用，由於SpringBoot在TomcatServletWebServerFactory代碼中寫了這個html
1 private long getSessionTimeoutInMinutes() { 2 Duration sessionTimeout = this.getSession().getTimeout(); 3 return this.isZeroOrLess(sessionTimeout) ? 0L : Math.max(sessionTimeout.toMinutes(), 1L); 4 }
⒈Session失效後如何跳轉到Session失效地址web
1 package cn.coreqi.security.config; 2 3 import cn.coreqi.security.Filter.SmsCodeFilter; 4 import cn.coreqi.security.Filter.ValidateCodeFilter; 5 import org.springframework.beans.factory.annotation.Autowired; 6 import org.springframework.context.annotation.Bean; 7 import org.springframework.context.annotation.Configuration; 8 import org.springframework.security.config.annotation.web.builders.HttpSecurity; 9 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; 10 import org.springframework.security.crypto.password.NoOpPasswordEncoder; 11 import org.springframework.security.crypto.password.PasswordEncoder; 12 import org.springframework.security.web.authentication.AuthenticationFailureHandler; 13 import org.springframework.security.web.authentication.AuthenticationSuccessHandler; 14 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; 15 16 @Configuration 17 public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 18 19 @Autowired 20 private AuthenticationSuccessHandler coreqiAuthenticationSuccessHandler; 21 22 @Autowired 23 private AuthenticationFailureHandler coreqiAuthenticationFailureHandler; 24 25 @Autowired 26 private SmsCodeAuthenticationSecurityConfig smsCodeAuthenticationSecurityConfig; 27 28 @Bean 29 public PasswordEncoder passwordEncoder(){ 30 return NoOpPasswordEncoder.getInstance(); 31 } 32 33 34 @Override 35 protected void configure(HttpSecurity http) throws Exception { 36 ValidateCodeFilter validateCodeFilter = new ValidateCodeFilter(); 37 validateCodeFilter.setAuthenticationFailureHandler(coreqiAuthenticationFailureHandler); 38 39 SmsCodeFilter smsCodeFilter = new SmsCodeFilter(); 40 41 42 //http.httpBasic() //httpBasic登陸 BasicAuthenticationFilter 43 http.addFilterBefore(smsCodeFilter, UsernamePasswordAuthenticationFilter.class) //加載用戶名密碼過濾器的前面 44 .addFilterBefore(validateCodeFilter, UsernamePasswordAuthenticationFilter.class) //加載用戶名密碼過濾器的前面 45 .formLogin() //表單登陸 UsernamePasswordAuthenticationFilter 46 .loginPage("/coreqi-signIn.html") //指定登陸頁面 47 //.loginPage("/authentication/require") 48 .loginProcessingUrl("/authentication/form") //指定表單提交的地址用於替換UsernamePasswordAuthenticationFilter默認的提交地址 49 .successHandler(coreqiAuthenticationSuccessHandler) //登陸成功之後要用咱們自定義的登陸成功處理器，不用Spring默認的。 50 .failureHandler(coreqiAuthenticationFailureHandler) //本身體會把 51 .and() 52 .sessionManagement() 53 .invalidSessionUrl("session/invalid") //session過時後跳轉的URL 54 .and() 55 .authorizeRequests() //對受權請求進行配置 56 .antMatchers("/coreqi-signIn.html","/code/image","/session/invalid").permitAll() //指定登陸頁面不須要身份認證 57 .anyRequest().authenticated() //任何請求都須要身份認證 58 .and().csrf().disable() //禁用CSRF 59 .apply(smsCodeAuthenticationSecurityConfig); 60 //FilterSecurityInterceptor 整個SpringSecurity過濾器鏈的最後一環 61 } 62 }
1 @GetMapping("/session/invalid") 2 @ResponseStatus(code = HttpStatus.UNAUTHORIZED) 3 public SimpleResponse sessionInvalid(){ 4 String message = "session失效"; 5 return new SimpleResponse(message); 6 }