Question

我的独立应用程序使用 Shiro 进行安全管理。我遇到了过期会话的问题。如果用户会话过期，当我尝试将用户重新登录时，我会收到以下异常。有人可以帮忙吗？

org.apache.shiro.session.UnknownSessionException: There is no session with id [d32af383-5f26-463f-a2f0-58a0e82c7890]
 at org.apache.shiro.session.mgt.eis.AbstractSessionDAO.readSession(AbstractSessionDAO.java:170)
 at org.apache.shiro.session.mgt.DefaultSessionManager.retrieveSessionFromDataSource(DefaultSessionManager.java:236)
 at org.apache.shiro.session.mgt.DefaultSessionManager.retrieveSession(DefaultSessionManager.java:222)
 at org.apache.shiro.session.mgt.AbstractValidatingSessionManager.doGetSession(AbstractValidatingSessionManager.java:118)
 at org.apache.shiro.session.mgt.AbstractNativeSessionManager.lookupSession(AbstractNativeSessionManager.java:105)
 at org.apache.shiro.session.mgt.AbstractNativeSessionManager.lookupRequiredSession(AbstractNativeSessionManager.java:109)
 at org.apache.shiro.session.mgt.AbstractNativeSessionManager.stop(AbstractNativeSessionManager.java:238)
 at org.apache.shiro.session.mgt.DelegatingSession.stop(DelegatingSession.java:127)
 at org.apache.shiro.session.ProxiedSession.stop(ProxiedSession.java:107)
 at org.apache.shiro.subject.support.DelegatingSubject$StoppingAwareProxiedSession.stop(DelegatingSubject.java:419)
 at org.apache.shiro.session.ProxiedSession.stop(ProxiedSession.java:107)
 at org.apache.shiro.subject.support.DelegatingSubject$StoppingAwareProxiedSession.stop(DelegatingSubject.java:419)

我使用spring来配置shiro

<bean id="securityManager" class="org.apache.shiro.mgt.DefaultSecurityManager"> 
    <property name="realm" ref="myRealm"/>
    <property name="sessionManager.globalSessionTimeout" value="3600000" />
</bean> 
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/> 
<bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">  
    <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/> 
    <property name="arguments" ref="securityManager"/> 
</bean>

Answer 1

使用远程ejb进行身份验证时，我遇到了同样的问题。

作为一种解决方法，第一次登录尝试是在try / catch块中捕获UnknownSessionException。然后从头开始构建Subject以再次登录用户。

UsernamePasswordToken token = new UsernamePasswordToken(username, password);
try {
    subject.login(token);
} catch (UnknownSessionException use) {
    subject = new Subject.Builder().buildSubject();
    subject.login(token);
    session = subject.getSession(true);
}

Shiro过期的会话处理

1 个答案: