我们如何在 Spring 中将 HttpSession 与 SessionRegistry 同步答案

【问题标题】：How would we sync HttpSession with SessionRegistry in Spring我们如何在 Spring 中将 HttpSession 与 SessionRegistry 同步
【发布时间】：2020-11-09 13:59:56
【问题描述】：

我们如何在 Spring 中同步 HttpSession 和 SessionRegistry

我有以下代码可以正常工作

    @Bean
    public SessionRegistry sessionRegistry() {
        return new SessionRegistryImpl();
    }
    @Bean
    public ConcurrentSessionFilter concurrentSessionFilter() {
        return new ConcurrentSessionFilter(sessionRegistry(), new SimpleRedirectSessionInformationExpiredStrategy("/"));
    }
    @Bean
    public ServletListenerRegistrationBean<HttpSessionEventPublisher> httpSessionEventPublisher() {
        return new ServletListenerRegistrationBean<HttpSessionEventPublisher>(new HttpSessionEventPublisher());
    }

//Autowired Session Registry

List<String> users = sessionRegistry.getAllPrincipals().stream()
                .filter(u -> !sessionRegistry.getAllSessions(u, false).isEmpty())
                .map(Object::toString)
                .collect(Collectors.toList());
        boolean expieredAtLeastOneSession = false;
        users.forEach(System.out::println);
        System.out.println(sessionRegistry.getAllPrincipals());
                        for (final Object user  : sessionRegistry.getAllPrincipals()) {
                            User actualUser = (User) user;
                            System.out.println("Testing 1");
                            List<SessionInformation> sessions = sessionRegistry.getAllSessions(user, true);
                            for(SessionInformation session : sessions) {
                                System.out.println("Testing 2");
                                session.expireNow();
                                sessionRegistry.removeSessionInformation(session.getSessionId());
                                publisher.publishEvent(AskToExpireSessionEvent.of(session.getSessionId()));
                                expieredAtLeastOneSession = true;
                            }
                        }

我的场景是，用户 A 登录，用户 B 登录，A 调用此方法使 B 的会话注册表无效/过期。直到这里它工作正常。但是，当 B 刷新页面时，他/她仍然处于登录状态！这是我的问题，如何防止B看到受限页面或者我也可以提出，HttpSession如何与SessionRegistry同步？

【问题讨论】：

标签： spring spring-boot spring-security

【解决方案1】：

这些设置有效

@Bean
    public SessionRegistry sessionRegistry() {
        return new SessionRegistryImpl();
    }
    @Bean
    public ConcurrentSessionFilter concurrentSessionFilter() {
        return new ConcurrentSessionFilter(sessionRegistry(), new SimpleRedirectSessionInformationExpiredStrategy("/"));
    }
    @Bean
    public ServletListenerRegistrationBean<HttpSessionEventPublisher> httpSessionEventPublisher() {
        return new ServletListenerRegistrationBean<HttpSessionEventPublisher>(new HttpSessionEventPublisher());
    }

    @Bean
    public ConcurrentSessionControlAuthenticationStrategy concurrentSessionControlAuthenticationStrategy() {

        ConcurrentSessionControlAuthenticationStrategy concurrentSessionControlAuthenticationStrategy =
                new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry());
        concurrentSessionControlAuthenticationStrategy.setExceptionIfMaximumExceeded(true);
        concurrentSessionControlAuthenticationStrategy.setMaximumSessions(1);
        return concurrentSessionControlAuthenticationStrategy;
    }

    @Bean
    public SessionFixationProtectionStrategy sessionFixationProtectionStrategy() {
        return new SessionFixationProtectionStrategy();
    }
    @Bean
    public RegisterSessionAuthenticationStrategy registerSessionAuthenticationStrategy() {
        return new RegisterSessionAuthenticationStrategy(sessionRegistry());
    }

    @Bean
    public CompositeSessionAuthenticationStrategy compositeSessionAuthenticationStrategy() {
        List<SessionAuthenticationStrategy> sessionAuthenticationStrategyList = new ArrayList<>();
        sessionAuthenticationStrategyList.add(concurrentSessionControlAuthenticationStrategy());
        sessionAuthenticationStrategyList.add(sessionFixationProtectionStrategy());
        sessionAuthenticationStrategyList.add(registerSessionAuthenticationStrategy());

        return new CompositeSessionAuthenticationStrategy(sessionAuthenticationStrategyList);
    }

和

http....and().sessionManagement()
                .maximumSessions(1).sessionRegistry(sessionRegistry()).expiredUrl("/logout")
                .and().sessionAuthenticationStrategy(compositeSessionAuthenticationStrategy());

现在它在刷新时注销用户。我想我应该对服务器设置一个（定期）Ajax 调用，以查看用户是否已登录，如果没有则重定向。

【讨论】：