1 spring security的session管理

spring security关于认证session的逻辑处理在接口SessionAuthenticationStrategy的onAuthentication方法中，先看看这个接口和其实现类。

1.1 SessionAuthenticationStrategy接口

public interface SessionAuthenticationStrategy {

        /**
         * 当一个认证生成之后处理session的逻辑
         *
         */
        void onAuthentication(Authentication authentication, HttpServletRequest request,
                        HttpServletResponse response) throws SessionAuthenticationException;

}

SessionAuthenticationStrategy只是一个接口，这个接口有很多实现类，但是spring security默认使用的是CompositeSessionAuthenticationStrategy，如下图所示：

1.2 CompositeSessionAuthenticationStrategy

直接看CompositeSessionAuthenticationStrategy的onAuthentication方法实现：

private final List<SessionAuthenticationStrategy> delegateStrategies;

public void onAuthentication(Authentication authentication,
                        HttpServletRequest request, HttpServletResponse response)
                                        throws SessionAuthenticationException {
                for (SessionAuthenticationStrategy delegate : this.delegateStrategies) {
                        if (this.logger.isDebugEnabled()) {
                                this.logger.debug("Delegating to " + delegate);
                        }
                        delegate.onAuthentication(authentication, request, response);
                }
        }

是不是很熟悉？CompositeSessionAuthenticationStrategy中有一个list集合存储着实现了SessionAuthenticationStrategy的类，然后遍历这个list，让它们去做正在的session逻辑操作。现在的问题是，这个delegateStrategies中到底存储的是那些实现类呢？如图所示：

1.3 onAuthentication的调用入口

前面说了spring security的认证流程是从AbstractAuthenticationProcessingFilter开始的，而认证相关的流程则是由其子类UsernamePasswordAuthenticationFilter来实现的。AbstractAuthenticationProcessingFilter中attemptAuthentication认证成功之后会调用SessionAuthenticationStrategy的onAuthentication方法来处理session相关逻辑。直接上代码

//session策略，默认的实现类是CompositeSessionAuthenticationStrategyprivate SessionAuthenticationStrategy sessionStrategy = new NullAuthenticatedSessionStrategy();

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
                        throws IOException, ServletException {
                HttpServletRequest request = (HttpServletRequest) req;
                HttpServletResponse response = (HttpServletResponse) res;
                if (!requiresAuthentication(request, response)) {
                        chain.doFilter(request, response);
                        return;
                }
                Authentication authResult;
                try {
                        authResult = attemptAuthentication(request, response);
                        if (authResult == null) {
                                // return immediately as subclass has indicated that it hasn't completed
                                // authentication
                                return;
                        }
                        //session管理的入口
                        sessionStrategy.onAuthentication(authResult, request, response);
                }
                catch (InternalAuthenticationServiceException failed) {
                        logger.error(
                                        "An internal error occurred while trying to authenticate the user.",
                                        failed);
                        unsuccessfulAuthentication(request, response, failed);

                        return;
                }
                catch (AuthenticationException failed) {
                        // Authentication failed
                        unsuccessfulAuthentication(request, response, failed);

                        return;
                }

                // Authentication success
                if (continueChainBeforeSuccessfulAuthentication) {
                        chain.doFilter(request, response);
                }

                successfulAuthentication(request, response, chain, authResult);
        }

2 SessionRegistry

可能有心急的小伙伴上来就想看ConcurrentSessionControlAuthenticationStrategy、ChangeSessionIdAuthenticationStrategy、RegisterSessionAuthenticationStrategy这三个strategy，但是有点抱歉，我们还缺点前置条件，这个条件就是SessionRegistry。搞明白SessionRegistry就搞明白了spring security是怎么保存用户对象和session的。

public interface SessionRegistry {
        /**
         * 获取所有的principal
         /
        List<Object> getAllPrincipals();

        /**
         * 获取principal的所有session
         /
        List<SessionInformation> getAllSessions(Object principal,boolean includeExpiredSessions);

        /**
         * 根据sessionId获取session的详细信息
         /
        SessionInformation getSessionInformation(String sessionId);

        /**
         * 根据sessionId刷新session信息
         /
        void refreshLastRequest(String sessionId);

        /**
         * 注册新的session信息
         /
        void registerNewSession(String sessionId, Object principal);

        /**
         * 根据sessionId删除session信息
         /
        void removeSessionInformation(String sessionId);
}

spring security通过SessionRegistryImpl来实现session信息的统一管理，先看这个类的属性：

public class SessionRegistryImpl implements SessionRegistry,
                ApplicationListener<SessionDestroyedEvent> {

        /** <principal:Object,SessionIdSet> */
    //principals的set集合中存储的是sessionId
        private final ConcurrentMap<Object, Set<String>> principals;
        /** <sessionId:Object,SessionInformation> */
        private final Map<String, SessionInformation> sessionIds;
}

有了principals和sessionIds的属性集合，存取操作这里我们就不用看了，最主要看registerNewSession方法和removeSessionInformation方法。但是有一点需要特别注意，principals是一个map，并且它的key是principal，我们自定义的实体类UserDO一定要重写equals和hashcode方法，否则同一个用户同时在不同的地方登录，后登录的用户是挤不掉前面登录的用户的！

2.1 registerNewSession方法

registerNewSession方法是一个比较简单的方法，没有什么特别的技巧就是集合的操作：

    public void registerNewSession(String sessionId, Object principal) {
                //1.判断sessionId是否存在，如存在则删除
                if (getSessionInformation(sessionId) != null) {
                        removeSessionInformation(sessionId);
                }
                //2.new一个SessionInformation放到sessionIds中
                sessionIds.put(sessionId,
                                new SessionInformation(principal, sessionId, new Date()));
                //3.添加到ConcurrentHashMap中
                principals.compute(principal, (key, sessionsUsedByPrincipal) -> {
                        if (sessionsUsedByPrincipal == null) {
                                sessionsUsedByPrincipal = new CopyOnWriteArraySet<>();
                        }
                        sessionsUsedByPrincipal.add(sessionId);

                        if (logger.isTraceEnabled()) {
                                logger.trace("Sessions used by '" + principal + "' : "
                                                + sessionsUsedByPrincipal);
                        }
                        return sessionsUsedByPrincipal;
                });
        }

瞄一眼session详细信息的实体类SessionInformation：

2.2 removeSessionInformation方法

    public void removeSessionInformation(String sessionId) {
                //1.更加sessionId获取session详细信息
                SessionInformation info = getSessionInformation(sessionId);
                //如果不存在直接返回
                if (info == null) {
                        return;
                }
                //2.sessionIds删除sessionId
                sessionIds.remove(sessionId);
                //3.principal中存储的是sessionId的set集合，将目标sessionId从set集合中删除
                principals.computeIfPresent(info.getPrincipal(), (key, sessionsUsedByPrincipal) -> {
                        if (logger.isDebugEnabled()) {
                                logger.debug("Removing session " + sessionId
                                                + " from principal's set of registered sessions");
                        }

                        sessionsUsedByPrincipal.remove(sessionId);

                        if (sessionsUsedByPrincipal.isEmpty()) {
                                // No need to keep object in principals Map anymore
                                if (logger.isDebugEnabled()) {
                                        logger.debug("Removing principal " + info.getPrincipal()
                                                        + " from registry");
                                }
                                sessionsUsedByPrincipal = null;
                        }

                        if (logger.isTraceEnabled()) {
                                logger.trace("Sessions used by '" + info.getPrincipal() + "' : "
                                                + sessionsUsedByPrincipal);
                        }
                        return sessionsUsedByPrincipal;
                });
        }

3 spring security的session管理

3.1 ConcurrentSessionControlAuthenticationStrategy

CompositeSessionAuthenticationStrategy的delegateStrategies中有3个SessionAuthenticationStrategy实现类，首当其冲的就是ConcurrentSessionControlAuthenticationStrategy，顾名思义它应该是session的并发管理。

    public void onAuthentication(Authentication authentication,
                        HttpServletRequest request, HttpServletResponse response) {
                //1.获取到用户所有的session信息
                final List<SessionInformation> sessions = sessionRegistry.getAllSessions(
                                authentication.getPrincipal(), false);
                int sessionCount = sessions.size();
                int allowedSessions = getMaximumSessionsForThisUser(authentication);
                //2.比较当前的session的数量和设定的最大允许session数量进行对吧
                if (sessionCount < allowedSessions) {
                        // They haven't got too many login sessions running at present
                        return;
                }
                if (allowedSessions == -1) {
                        // We permit unlimited logins
                        return;
                }
                if (sessionCount == allowedSessions) {
                        HttpSession session = request.getSession(false);
                        if (session != null) {
                                // Only permit it though if this request is associated with one of the
                                // already registered sessions
                                for (SessionInformation si : sessions) {
                                        if (si.getSessionId().equals(session.getId())) {
                                                return;
                                        }
                                }
                        }
                }
                //3.抛异常或者是按session生成的时间进行排序，抛弃掉早先生成的session，保持session数量为允许的size
                allowableSessionsExceeded(sessions, allowedSessions, sessionRegistry);
        }

3.2 ChangeSessionIdAuthenticationStrategy

ChangeSessionIdAuthenticationStrategy中的onAuthentication方法其实是由父类AbstractSessionFixationProtectionStrategy实现的。这个方法就是防止固定会话攻击，会一直不停的修改你的sessionId。

public void onAuthentication(Authentication authentication,
                        HttpServletRequest request, HttpServletResponse response) {
                boolean hadSessionAlready = request.getSession(false) != null;
                //1.session不存在直接返回
                if (!hadSessionAlready && !alwaysCreateSession) {
                        return;
                }
                HttpSession session = request.getSession();
                //2.如果session存在的话则创建一个新的session覆盖老的session，sessionId也会改变
                if (hadSessionAlready && request.isRequestedSessionIdValid()) {
                        String originalSessionId;
                        String newSessionId;
                        Object mutex = WebUtils.getSessionMutex(session);
                        synchronized (mutex) {
                                // We need to migrate to a new session
                                originalSessionId = session.getId();

                                session = applySessionFixation(request);
                                newSessionId = session.getId();
                        }
                        if (originalSessionId.equals(newSessionId)) {
                                logger.warn("Your servlet container did not change the session ID when a new session was created. You will"
                                                + " not be adequately protected against session-fixation attacks");
                        }
                        onSessionChange(originalSessionId, session, authentication);
                }
        }

3.3 RegisterSessionAuthenticationStrategy

RegisterSessionAuthenticationStrategy的onAuthentication方法是最简单的，就是注册一个新的sessionId。

public void onAuthentication(Authentication authentication,
                        HttpServletRequest request, HttpServletResponse response) {
                sessionRegistry.registerNewSession(request.getSession().getId(),
                                authentication.getPrincipal());
        }

4.session共享

说到底SessionRegistryImpl是基于内存的session管理，我们在开发中经常要用到session共享。那么spring security提供的默认session注册表就不再起作用了，其实SessionRegistry是有2种实现的。看看另外一种实现SpringSessionBackedSessionRegistry：

对于session的操作方法上面已经讲过，只不过是存储介质的不同，这里就不再赘述，我们主要关心FindByIndexNameSessionRepository，对于session的所有处理都是由这个类来处理的。

RedisIndexedSessionRepository实现了这个类，而RedisIndexedSessionRepository的实现则由spring-session-data-redis提供，换句话说如果我们想实现session的共享直接依赖这个jar包，然后将session的存储介质改为redis即可。

4 总结

在spring security中sessionId的生成和处理逻辑要经历这三个strategy，sessionId每一次请求都会变化用来防止固定会话攻击。如果对session的最大size做了限制在ConcurrentSessionControlAuthenticationStrategy会有一个淘汰策略，永远取最新生成的session。SessionRegistryImpl是基于内存的session管理，我们在开发中经常要用到session共享，那就依赖spring-session-data-redis即可。