Question

我正在处理一项任务，我需要在login-logout日志表中更新注销时间。我已配置自动会话过期时间。如果注销其更新数据库，但在会话自动注销的情况下，其未更新数据库。我尝试了很多东西，比如keepSessionAlive（）。我也在sessionDestroyed上试过onApplicationEvent，但没有任何对我有用。

这里是SessionListener.java

@Component
public class SessionListener implements HttpSessionListener, 
ApplicationListener<SessionDestroyedEvent> {

@Autowired
LoginLogoutLogService loginLogoutLogService;

@Override
public void sessionCreated(HttpSessionEvent event) {
    event.getSession().setMaxInactiveInterval(1 * 60);
}

@Override
public void sessionDestroyed(HttpSessionEvent event) {
    HttpSession session = event.getSession();
    LoginDetailsBean loginDetailsBean = (LoginDetailsBean) session.getAttribute("loginUser");
    String loginTimeStamp = DateHelper.dateToString(loginDetailsBean.getLoginTimestamp());
    String logoutTimeStamp = DateHelper.dateToString(new Date());
    String loginId = loginDetailsBean.getLoginUserid();
    // updateLogoutTime(logoutTimeStamp,loginId,loginTimeStamp); 
    System.out.printf("Session ID %s destroyed at %s%n", event.getSession().getId(), new Date());
}

@Override
public void onApplicationEvent(SessionDestroyedEvent event) {
    System.out.println("Bofore Destroyed....");
}

public void updateLogoutTime(String logoutTimeStamp, String loginId, String loginTimeStemp) {
    loginLogoutLogService.updateLogoutTime(logoutTimeStamp, loginId, loginTimeStemp);
    System.out.println("Database update successfully...");
}

}

所以请告诉我如何在spring security中的sessionDestroyed之前更新数据库。

Answer 1

这可能是你可以使用HttpSessionBindingListener并通过调用registerSession来注册一个持有锁的会话的可能性

public class HttpSessionLock implements Serializable,HttpSessionBindingListener {
    public void valueBound(HttpSessionBindingEvent event) {
        log.info("valueBound:" + event.getName() + " session:" + event.getSession().getId() );

    }

public void registerSession() {        
    log.info( "registered sessionBindingListener"  );
}

public void valueUnbound(HttpSessionBindingEvent event) {
    log.info("valueUnBound:" + event.getName() + " session:" + event.getSession().getId() );

    log.info( "unregistering sessionBindingListener"  );
    // coding for db
    }
    }

Answer 2

此代码可以正常工作.....

package com.auction.web.security;

import java.io.Serializable;
import java.util.Date;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
import javax.servlet.http.HttpSessionBindingEvent;
import javax.servlet.http.HttpSessionBindingListener;
import javax.servlet.http.HttpSessionEvent;
import javax.servlet.http.HttpSessionListener;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.ApplicationListener;
import org.springframework.security.core.session.SessionDestroyedEvent;
import org.springframework.stereotype.Component;

import com.auction.commons.util.DateHelper;
import com.auction.model.bean.LoginDetailsBean;
import com.auction.service.LoginLogoutLogService;

@Component 
public class SessionListener implements HttpSessionListener, ApplicationListener<SessionDestroyedEvent>,Serializable,HttpSessionBindingListener{

/**
 * 
 */
private static final long serialVersionUID = 1L;

@Autowired
LoginLogoutLogService loginLogoutLogService;

@Override
public void sessionCreated(HttpSessionEvent event) {
    event.getSession().setMaxInactiveInterval(1 * 60);
}

@Override
public void sessionDestroyed(HttpSessionEvent event) {
    /*HttpSession session = event.getSession();
    LoginDetailsBean loginDetailsBean = (LoginDetailsBean) session.getAttribute("loginUser");
    String loginTimeStamp = DateHelper.dateToString(loginDetailsBean.getLoginTimestamp());
    String logoutTimeStamp = DateHelper.dateToString(new Date());
    String loginId = loginDetailsBean.getLoginUserid();*/
    // updateLogoutTime(logoutTimeStamp,loginId,loginTimeStamp); 
    System.out.printf("Session ID %s destroyed at %s%n", event.getSession().getId(), new Date());
}

@Override
public void onApplicationEvent(SessionDestroyedEvent event) {

    HttpSession session = (HttpSession) event.getSource();
    LoginDetailsBean loginDetailsBean = (LoginDetailsBean) session.getAttribute("loginUser");
    String loginTimeStamp = DateHelper.dateToString(loginDetailsBean.getLoginTimestamp());
    String logoutTimeStamp = DateHelper.dateToString(new Date());
    String loginId = loginDetailsBean.getLoginUserid();
    updateLogoutTime(logoutTimeStamp,loginId,loginTimeStamp);
}

public void updateLogoutTime(String logoutTimeStamp, String loginId, String loginTimeStemp) {
    loginLogoutLogService.updateLogoutTime(logoutTimeStamp, loginId, loginTimeStemp);
    System.out.println("Database update successfully...");
}

@Override
public void valueBound(HttpSessionBindingEvent event) {
    System.out.println("valueBound:" + event.getName() + " session:" + event.getSession().getId() );

}

public void registerSession() {
   // FacesContext.getCurrentInstance().getExternalContext().getSessionMap().put( "sessionBindingListener", this  );
    System.out.println( "registered sessionBindingListener"  );
}

@Override
public void valueUnbound(HttpSessionBindingEvent event) {
   System.out.println("valueUnBound:" + event.getName() + " session:" + event.getSession().getId() );
           // add you unlock code here:
   // clearLocksForSession( event.getSession().getId() );
}

}

如何在会话之前更新数据库在Spring类的Spring安全性中被破坏？

2 个答案: