代码之家 › 专栏 › 技术社区 › Harita Parmar

弹簧靴过期或不工作

session-management vaadin spring-security spring-boot

Harita Parmar · 技术社区 · 6 年前

我有“Vaadin 10 with Spring Boot”应用程序。我想允许用户一次从一个地方访问应用程序。所以我使用最大值会话(1)。例如,在Chrome浏览器中,我使用用户“XYZ”登录。现在,使用同一个用户(即“XYZ”)我尝试登录到Opera浏览器。因此,根据下面的配置,它将使Chrome浏览器的会话过期,但不会重定向到“/login”。它显示信息 “来自服务器的无效JSON响应” . 以下是Spring安全配置:

@Override
protected void configure(HttpSecurity http) throws Exception {
    // Not using Spring CSRF here to be able to use plain HTML for the login page
    http.csrf().disable()

            // Register our CustomRequestCache, that saves unauthorized access attempts, so
            // the user is redirected after login.
            .requestCache().requestCache(new CustomRequestCache())

            // Restrict access to our application.
            .and().authorizeRequests()
            .antMatchers("/ForgetPassword","/ChangePassword","/login").permitAll()
            // Allow all flow internal requests.
            .requestMatchers(SecurityUtils::isFrameworkInternalRequest).permitAll()

            // Allow all requests by logged in users.
            .anyRequest().authenticated()
            // Configure the login page.
            .and().formLogin().loginPage("/login").permitAll().loginProcessingUrl("/login")
            .failureUrl("/login?error")

            // Register the success handler that redirects users to the page they last tried
            // to access
            .successHandler(new SavedRequestAwareAuthenticationSuccessHandler())

            // Configure logout
            .and().logout().logoutSuccessUrl(LOGOUT_SUCCESS_URL)
            .deleteCookies("JSESSIONID")
            //.invalidateHttpSession(true)
            .and()
            .sessionManagement()
            //.invalidSessionUrl("/login")
            .maximumSessions(1)
            //.maxSessionsPreventsLogin(false)
            .sessionRegistry(sessionRegistry())
            .expiredUrl("/login");

1 回复 | 直到 6 年前

Tulio 6 年前

问题是,通过重定向请求,Vaadin接收登录页面作为对内部请求的响应。

这似乎有效:

        .expiredSessionStrategy(e -> {
            final String redirectUrl = e.getRequest().getContextPath() + "/login";
            if(SecurityUtils.isFrameworkInternalRequest(e.getRequest())) {
                e.getResponse().setHeader("Content-Type", "text/plain");
                e.getResponse().getWriter().write("Vaadin-Refresh: " + redirectUrl);
            } else {
                e.getResponse().sendRedirect(redirectUrl);
            }
        });

它记录在连接状态处理程序

public interface ConnectionStateHandler {

/**
 * A string that, if found in a non-JSON response to a UIDL request, will
 * cause the browser to refresh the page. If followed by a colon, optional
 * whitespace, and a URI, causes the browser to synchronously load the URI.
 *
 * <p>
 * This allows, for instance, a servlet filter to redirect the application
 * to a custom login page when the session expires. For example:
 * </p>
 *
 * <pre>
 * if (sessionExpired) {
 *     response.setHeader(&quot;Content-Type&quot;, &quot;text/html&quot;);
 *     response.getWriter().write(myLoginPageHtml + &quot;&lt;!-- Vaadin-Refresh: &quot;
 *             + request.getContextPath() + &quot; --&gt;&quot;);
 * }
 * </pre>
 */
String UIDL_REFRESH_TOKEN = "Vaadin-Refresh";