Question

我正在使用带有Spring Security ver4.0.1.RELEASE的Spring MVC。我试图将并发用户登录控制为1并在用户已登录时显示错误消息。并发会话管理按预期工作，但expireUrl（＆＃34;＆＃34;）无法正常工作。始终调用.formLogin（）。loginPage（＆＃34;＆＃34;）。failureUrl（＆＃34;＆＃34;）而不是expireUrl（＆＃34;＆＃34;）。请帮忙。

下面是我的SpringSecurityConfiguration.java，它扩展了WebSecurityConfigurerAdapter

protected void configure(HttpSecurity http) throws Exception {
  http.authorizeRequests()
  .antMatchers("/resources/**").permitAll()
    .antMatchers("/", "/home").permitAll()
    .antMatchers("/Access_Denied").permitAll()
    .antMatchers("/login").permitAll()      
    .and().formLogin().loginPage("/login")
    .failureUrl("/login?out=1")
    .usernameParameter("userID").passwordParameter("password")
    .and().csrf().and()
    .logout()
    .deleteCookies( "JSESSIONID" )
    .logoutSuccessUrl( "/logout" )
    .invalidateHttpSession( true )
    .and().exceptionHandling().accessDeniedPage("/accessDenied.jsp")
    .and()
    .sessionManagement()
    .maximumSessions(1) 
    expiredUrl("/login?time=1")
    .sessionRegistry(sessionRegistry);   
}

我的初始化程序类如下所示 -

protected Filter[] getServletFilters() {
    return new Filter[] { new HiddenHttpMethodFilter() };
}


public void onStartup(ServletContext servletContext) throws ServletException {
    super.onStartup(servletContext);
    servletContext.addListener(new SessionListener());
    servletContext.addListener(new CustomHttpSessionEventPublisher());
}

以下链接提供了此类安全配置的额外信息 -

http://codehustler.org/blog/spring-security-tutorial-form-login-java-config/ https://gerrydevstory.com/2015/08/02/managing-spring-security-user-session/

Answer 1

您是否尝试过在链上移动会话管理？

protected void configure(HttpSecurity http) throws Exception {
  http.authorizeRequests()
  .antMatchers("/resources/**").permitAll()
    .antMatchers("/", "/home").permitAll()
    .antMatchers("/Access_Denied").permitAll()
    .antMatchers("/login").permitAll()   
    .and().sessionManagement()
    .maximumSessions(1) 
    .expiredUrl("/login?time=1")
    .sessionRegistry(sessionRegistry);   
    .and().formLogin().loginPage("/login")
    .failureUrl("/login?out=1")
    .usernameParameter("userID").passwordParameter("password")
    .and().csrf().and()
    .logout()
    .deleteCookies( "JSESSIONID" )
    .logoutSuccessUrl( "/logout" )
    .invalidateHttpSession( true )
    .and().exceptionHandling().accessDeniedPage("/accessDenied.jsp")       
}

并发会话管理总是重定向到failureurl - Java Config

1 个答案: