首页 发现 帮助
注册 登录
github
/
spring-security
镜像自地址 https://github.com/spring-projects/spring-security
2
0
派生 0
文件 工单管理 0 Wiki
浏览代码

SEC-1379: Added creation of a session if session timeout is detected (requested session ID is invalid).

This prevents problems with repeated detection of the same invalid session when the redirected request comes in.
Luke Taylor 15 年之前
父节点
d931495c8a
当前提交
0974e21fb6
共有 3 个文件被更改，包括 16 次插入 和 2 次删除
分列视图 显示文件统计
  1. 1 1
      samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security.xml
  2. 13 0
      samples/tutorial/src/main/webapp/timeout.jsp
  3. 2 1
      web/src/main/java/org/springframework/security/web/session/SessionManagementFilter.java

+ 1 - 1
samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security.xml
查看文件 

@@ -33,7 +33,7 @@
 
         <x509 />
 
 -->
 
         <!-- Uncomment to limit the number of sessions a user can have -->
 
-        <session-management invalid-session-url="/something">
 
+        <session-management invalid-session-url="/timeout.jsp">
 
             <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
 
         </session-management>

+ 13 - 0
samples/tutorial/src/main/webapp/timeout.jsp
查看文件 

@@ -0,0 +1,13 @@
 
+<%@page session="false" %>
 
+<%@ taglib prefix="c" uri="http://java.sun.com/jstl/core_rt"%>
 
+
 
+<html>
 
+<title>Session Timeout</title>
 
+<body>
 
+<h2>Invalid Session</h2>
 
+
 
+<p>
 
+Your session appears to have timed out. Please <a href="<c:url value='/'/>">start again</a>.
 
+</p>
 
+</body>
 
+</html>

+ 2 - 1
web/src/main/java/org/springframework/security/web/session/SessionManagementFilter.java
查看文件 

@@ -84,7 +84,8 @@ public class SessionManagementFilter extends GenericFilterBean {
 
                     logger.debug("Requested session ID" + request.getRequestedSessionId() + " is invalid.");
 
 
                     if (invalidSessionUrl != null) {
 
-                        logger.debug("Redirecting to '" + invalidSessionUrl + "'");
 
+                        logger.debug("Starting new session (if required) and redirecting to '" + invalidSessionUrl + "'");
 
+                        request.getSession();
 
                         redirectStrategy.sendRedirect(request, response, invalidSessionUrl);
 
 
                         return;