Question

我使用带有redis支持会话的spring。如果我访问该站点，我会看到会话已添加到数据库中。然后我在数据库上运行flushdb。然后我尝试访问该站点，并且会话仍然存在（我有相同的会话ID。）redis键是不同的，但会话ID是相同的。会话是否存储在其他地方而不是redis中？这是预期的吗？

使用Windows 64位redis 2.8.2400。

一些pom依赖。

    <dependency>
        <groupId>org.springframework.data</groupId>
        <artifactId>spring-data-redis</artifactId>
        <version>1.6.2.RELEASE</version>
    </dependency>

    <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-pool2</artifactId>
        <version>2.2</version>
    </dependency>

    <dependency>
        <groupId>redis.clients</groupId>
        <artifactId>jedis</artifactId>
        <version>2.8.0</version>
    </dependency>

    <dependency>
        <groupId>org.springframework.session</groupId>
        <artifactId>spring-session-data-redis</artifactId>
        <version>1.0.2.RELEASE</version>
    </dependency>


    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-config</artifactId>
        <version>4.0.3.RELEASE</version>
    </dependency>
 <!--  -->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-web</artifactId>
        <version>4.0.3.RELEASE</version>
    </dependency>

Relavent Beans

<beans:bean id="RedisHttpSessionConfiguration" 
    class="org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration" />
<beans:bean
    class="org.springframework.data.redis.connection.jedis.JedisConnectionFactory"
    p:port="6379" />

一些web.xml

<listener>
        <listener-class>com.mysite.listeners.sessionStarted</listener-class>
    </listener>

<filter>
        <filter-name>springSessionRepositoryFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSessionRepositoryFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

关闭会话的控制器功能

RequestMapping(value = "/closeSession", method = RequestMethod.GET)
    public String closeSession(HttpSession session, HttpServletRequest request) {
        logger.info("Closeing Session (greri002 for testing).");
        session.invalidate();
        //request.logout();
        SecurityContextHolder.getContext().setAuthentication(null);
        return "OK";
    }

Answer 1

Spring安全性正在管理以redis格式存储数据的会话。如果您计划在节点之间共享会话数据，则只需要引入类似redis的东西。

Spring的SecurityContext，其中存储了安全信息。 https://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/core/context/SecurityContext.html

假设您正在使用支持3.0 Servlet的服务器，您只需要在HttpServletRequest对象上调用logout（）。春季MVC样本 -

@RequestMapping(value="/me/logout", method=RequestMethod.GET)
public @ResponseBody String logout(HttpServletRequest request) throws ServletException {
    request.logout();
    return "OK";
}

http://docs.spring.io/spring-security/site/docs/3.2.1.CI-SNAPSHOT/reference/htmlsingle/#servletapi-logout

如果您无法访问HttpServletRequest，则可以执行

SecurityContextHolder.getContext().setAuthentication(null);

还要确保正确注销http config配置。他是我的

    <sec:logout logout-url="/logout"
                delete-cookies="JSESSIONID,jsessionid"
                invalidate-session="true"
                success-handler-ref="myLogoutFilter"/>

为什么我的会话还活着

1 个答案: