Question

我在grails 2.4.4应用程序中使用spring-security-core 2.0。我将用户的并发会话访问限制为1。所以问题是在30分钟的会话超时之后我无法用该用户名和密码登录，它会抛出并发会话最大超出异常。我怀疑，在会话超时时，我的注销无法正常工作，因此会话仍然可以处于活动状态。

我是弹簧安全的新手，所以有人能告诉我该做什么吗？

我在这里给出了我在代码中对限制并发访问所做的更改。

resources.groovy

＆＃13;

// Place your Spring DSL code here
/*beans = {
	messageSource(org.springframework.context.support.ReloadableResourceBundleMessageSource) { basename = "classpath:grails-app/src/resource_bundle" }
}*/

import org.springframework.security.core.session.SessionRegistryImpl;
import org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy;
import org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy;
import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy;
import org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy;
import com.custom.sessiontime.CustomSessionLogoutHandler

beans = { 
 	 
	 sessionRegistry(SessionRegistryImpl)
	 
	 customSessionLogoutHandler(CustomSessionLogoutHandler,ref('sessionRegistry'))
	 
	 concurrentSessionControlAuthenticationStrategy(ConcurrentSessionControlAuthenticationStrategy,ref('sessionRegistry')){
		 exceptionIfMaximumExceeded = true
		 maximumSessions = 1
	 }
	 
	 sessionFixationProtectionStrategy(SessionFixationProtectionStrategy){
		 migrateSessionAttributes = true
		 alwaysCreateSession = true
	 }
	 registerSessionAuthenticationStrategy(RegisterSessionAuthenticationStrategy,ref('sessionRegistry'))
	 
	 sessionAuthenticationStrategy(CompositeSessionAuthenticationStrategy,[ref('concurrentSessionControlAuthenticationStrategy'),ref('sessionFixationProtectionStrategy'),ref('registerSessionAuthenticationStrategy')])

   }

＆＃13;

CustomSessionLogoutHandler

＆＃13;

package com.custom.sessiontime

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.logout.LogoutHandler;
import org.springframework.util.Assert;
import org.springframework.security.core.session.SessionRegistry;

/**
 * {@link CustomSessionLogoutHandler} is in charge of removing the {@link SessionRegistry} upon logout. A
 * new {@link SessionRegistry} will then be generated by the framework upon the next request.
 *
 * @author Mohd Qusyairi
 * @since 0.1
 */
public final class CustomSessionLogoutHandler implements LogoutHandler {
    private final SessionRegistry sessionRegistry;

    /**
     * Creates a new instance
     * @param sessionRegistry the {@link SessionRegistry} to use
     */
    public CustomSessionLogoutHandler(SessionRegistry sessionRegistry) {
        Assert.notNull(sessionRegistry, "sessionRegistry cannot be null");
        this.sessionRegistry = sessionRegistry;
    }

    /**
     * Clears the {@link SessionRegistry}
     *
     * @see org.springframework.security.web.authentication.logout.LogoutHandler#logout(javax.servlet.http.HttpServletRequest,
     * javax.servlet.http.HttpServletResponse,
     * org.springframework.security.core.Authentication)
     */
    public void logout(HttpServletRequest request, HttpServletResponse response,
            Authentication authentication) {
        this.sessionRegistry.removeSessionInformation(request.getSession().getId());
    }
}

＆＃13;

最后在下面添加到Config.groovy

grails.plugin.springsecurity.logout.handlerNames = ['customSessionLogoutHandler','securityContextLogoutHandler','rememberMeServices']

spring-security会话在超时时没有正确无效

0 个答案: