如何在Spring Security中设置自定义无效会话策略

Question

我正在开发基于Spring-Boot-1.1.6，Spring-Security -3.2.5等的Web应用程序。

我使用基于Java的配置：

@Configuration 
@EnableWebMvcSecurity 
public class SecurityCtxConfig extends WebSecurityConfigurerAdapter { 


    @Bean 
    DelegatingAuthenticationEntryPoint delegatingAuthenticationEntryPoint() { 
     LinkedHashMap<RequestMatcher, AuthenticationEntryPoint> map = new LinkedHashMap<RequestMatcher, AuthenticationEntryPoint>(); 
     Http403ForbiddenEntryPoint defaultEntryPoint = new Http403ForbiddenEntryPoint(); 
     map.put(AnyRequestMatcher.INSTANCE, defaultEntryPoint); 
     DelegatingAuthenticationEntryPoint retVal = new DelegatingAuthenticationEntryPoint(map); 
     retVal.setDefaultEntryPoint(defaultEntryPoint); 
     return retVal; 
    } 


    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     ExceptionHandlingConfigurer<HttpSecurity> exceptionHandling = http.exceptionHandling(); 
     exceptionHandling.authenticationEntryPoint(delegatingAuthenticationEntryPoint()); 
     http.logout().logoutSuccessHandler(new LogoutSuccessHandler() { 

      @Override 
      public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication arg2) 
        throws IOException, ServletException { 
       response.setStatus(HttpServletResponse.SC_OK); 
      } 
     }); 
    } 

} 

的要求是在会话cookie无效或丢失（无论原因） 情况下，返回HTTP状态401我看到了InvalidSessionStrategy，但我请勿在SessionManagementFilter上找到设置它的方法。 有人可以请我安装如何实现我的计划或另一个将满足要求

Answer 1

由于我使用AspectJ（我的意思是编译时编织而不是Spring AOP），所以很容易破解SessionManagementFilter创作由SessionManagementFilter后设定我的自定义InvalidSessionStrategy构造：

@Aspect 
public class SessionManagementAspect { 
    private static final Log logger = LogFactory.getLog(); 

    @AfterReturning("execution(org.springframework.security.web.session.SessionManagementFilter.new(..))&&this(smf)") 
    public void creation(JoinPoint pjp, SessionManagementFilter smf) throws Throwable { 
     logger.debug("Adding/Replacing the invalid session detection policy to return 401 in case of an invalid session"); 
     smf.setInvalidSessionStrategy(new InvalidSessionStrategy() { 

      @Override 
      public void onInvalidSessionDetected(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException { 
       logInvalidSession(request, "invalid cookie"); 
       if (!response.isCommitted()) 
        response.sendError(HttpStatus.UNAUTHORIZED.value()); 
      } 
     }); 
    } 
} 

如果不使用AspectJ，尝试添加@Component和这方面添加到您的背景下，如果SessionManagementFilter是一个bean它可能工作（由于春节-AOP applias只限于春豆）

Answer 2

我们有完全相同的问题，我做了这个黑客解决它（是的，我知道，这是一个黑客，因此名称......）。 我创建了一个BeanPostProcessor和搜索SessionManagementFilter重新配置它...

@Bean 
public HackyBeanPostProcessor myBeanPostProcessor() { 
    return new HackyBeanPostProcessor(); 
} 

protected static class HackyBeanPostProcessor implements BeanPostProcessor { 

    @Override 
    public Object postProcessBeforeInitialization(Object bean, String beanName) { 
     // FIXME check if a new spring-security version allows this in an 
     // other way (current: 3.2.5.RELEASE) 
     if (bean instanceof SessionManagementFilter) { 
      SessionManagementFilter filter = (SessionManagementFilter) bean; 
      filter.setInvalidSessionStrategy(new InvalidSessionStrategy() { 

       @Override 
       public void onInvalidSessionDetected(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException { 
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED); 
       } 
      }); 
     } 
     return bean; 
    } 

    @Override 
    public Object postProcessAfterInitialization(Object bean, String beanName) { 
     return bean; 
    } 
} 

Answer 3

使用SpringBoot这个工作对我来说：

@Configuration 
@EnableWebSecurity 
public class UISecurityConfig extends WebSecurityConfigurerAdapter { 
    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     ... 
     http.addFilterAfter(expiredSessionFilter(), SessionManagementFilter.class); 
     ... 
    } 

    private Filter expiredSessionFilter() { 
     SessionManagementFilter smf = new SessionManagementFilter(new HttpSessionSecurityContextRepository()); 
     smf.setInvalidSessionStrategy((request, response) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Session go BOOM!"));    
     return smf; 
    } 
}