struts2+springsecurity+spring-session-data-redis使用redis存储session

「爱情、让人受尽委屈。」 2022-03-01 04:42 512阅读 0赞

springsecurity做权限验证，采用默认的session管理，在系统重新部署启动之后，之前登录的用户session无法被保存，需要用户重新登录，这里使用redis来做session存储，系统重启之后，session还在，无需重新登录。

使用redis做session存储，本身配置比较简单，但是这里和struts2结合，就需要注意。

springSessionRepositoryFilter的映射配置需要在springsecurity和struts2的filter前面。要不然，还是不会生效。

首先需要增加spring-session-data-redis的依赖。

<dependency>
    	<groupId>org.springframework.session</groupId>
    	<artifactId>spring-session-data-redis</artifactId>
    	<version>1.3.5.RELEASE</version>
    </dependency>

其次，需要配置redis连接和redis session相关的bean，让spring去管理redis的连接。

spring-redis.xml

在spring-security.xml配置文件中，增加redis session相关的配置。

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
    	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xmlns:sec="http://www.springframework.org/schema/security"
    	xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.2.xsd
    	http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    
        <bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" />
        <bean id="sessionAuthenticationStrategy" class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy">
             <constructor-arg>
                <list>
                     <bean class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
                        <constructor-arg ref="sessionRegistry" />
                     </bean>
                     <bean class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy"></bean>
                     <bean class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy">
                         <constructor-arg ref="sessionRegistry" />
                     </bean>
                </list>
             </constructor-arg>
        </bean>
        <sec:http pattern="/" security="none"/>
        <sec:http auto-config="true" authentication-manager-ref="authentication-manager">
            <sec:intercept-url pattern="/**" access="isAuthenticated()"/>
            <sec:form-login 
               login-page="/"
            		login-processing-url="/login"
             		default-target-url="/admin/user!list.action"
             		authentication-failure-url="/"
             		username-parameter="username"
             		password-parameter="password"
            />
            <sec:headers disabled="true"/>
            <sec:csrf disabled="true"/>
            <sec:logout logout-url="/logout" logout-success-url="/"/>
            <sec:session-management invalid-session-url="/" session-authentication-strategy-ref="sessionAuthenticationStrategy"/>
        </sec:http>
        <bean id="securityUserDetailsService" class="com.xxx.ssh.web.service.impl.SecurityUserDetailsService">
        </bean>
        <sec:authentication-manager id="authentication-manager">
            <sec:authentication-provider user-service-ref="securityUserDetailsService">
               <sec:password-encoder hash="md5"/>
            </sec:authentication-provider>
        </sec:authentication-manager>
    </beans>

web.xml配置的详细配置：

<?xml version="1.0" encoding="UTF-8"?>
    <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
        <display-name>ssh</display-name>
    	<context-param>
    		<param-name>contextConfigLocation</param-name>
    		<param-value>classpath:spring.xml,classpath:spring-security.xml</param-value>
    	</context-param>
    	<listener>
    		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    	</listener>
    	<filter>
    	      <filter-name>ssh</filter-name>
    	      <filter-class>org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter</filter-class>
    	 </filter>	 
    	<filter>
    	       <filter-name>springSecurityFilterChain</filter-name>
    	       <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    	</filter>
    	<filter>
    	       <filter-name>springSessionRepositoryFilter</filter-name>
    	       <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    	</filter>
    	<filter-mapping>
    	      <filter-name>springSessionRepositoryFilter</filter-name>
    	      <url-pattern>/*</url-pattern>
    	</filter-mapping>
    	<filter-mapping>
    	      <filter-name>springSecurityFilterChain</filter-name>
    	      <url-pattern>/*</url-pattern>
    	</filter-mapping>		
    	<filter-mapping>
    	      <filter-name>ssh</filter-name>
    	      <url-pattern>/*</url-pattern>
    	</filter-mapping>
    </web-app>

这里尤其要注意三个filter的顺序，springsession-springsecurity-struts2。这里虽然springSessionRepositoryFilter和springSecurityFilterChain对应的filter-class是一个，但是还是需要配置两遍。

经过这样的配置，无需编写java代码，就可以实现redis存储session，项目重新部署，用户会无感知。无需重新登录。

用户登录之后存储在redis中的session相关的信息：

![20190321180526705.png][]

完整项目代码地址：https://github.com/buejee/ssh.git

[20190321180526705.png]: /images/20220301/34f51fd603f243a482b06eff9e283b90.png