shiro安全框架挺不错的,小巧灵活;然后遇到个大家都应该遇到过的问题就是当用户退出或者异常关闭浏览器的时候不会自动清除缓存授权信息,当然shiro是有个玩意会自动扫描过期的会话,但是它只会清除会话信息不会清除cache里面的信息,下面看这个解决方案
<!– 默认会话管理器 –>
<bean id=”sessionManager”
class=”com.shadow.shiro.extend.session.impl.SimpleWebSessionManager”>
<property name=”globalSessionTimeout” value=”15000″ />
<property name=”sessionValidationInterval” value=”30000″ />
<property name=”sessionValidationSchedulerEnabled” value=”true” />
</bean>
全局的会话信息设置成15秒,检测扫描信息间隔30秒,第三个参数就是是否开启扫描
至于我的sessionManager实现类是自己继承,然后重写了其中一个方法
import java.util.Collection;
import java.util.Iterator;
import org.apache.log4j.Logger;
import org.apache.shiro.cache.CacheManager;
import org.apache.shiro.session.ExpiredSessionException;
import org.apache.shiro.session.InvalidSessionException;
import org.apache.shiro.session.Session;
import org.apache.shiro.session.mgt.DefaultSessionKey;
import org.apache.shiro.session.mgt.SessionKey;
import org.apache.shiro.session.mgt.SimpleSession;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import com.shadow.shiro.extend.session.WebSessionManager;
/**
* 会话管理器
*/
public class SimpleWebSessionManager extends DefaultWebSessionManager implements
WebSessionManager {
private CacheManager cacheManager;
private final static Logger logger = Logger
.getLogger(SimpleWebSessionManager.class);
public SimpleWebSessionManager() {
super();
}
public void validateSessions() {
if (logger.isInfoEnabled())
logger.info(“Validating all active sessions…”);
int invalidCount = 0;
Collection<?> activeSessions = getActiveSessions();
if (activeSessions != null && !activeSessions.isEmpty()) {
for (Iterator<?> i$ = activeSessions.iterator(); i$.hasNext();) {
Session session = (Session) i$.next();
try {
SessionKey key = new DefaultSessionKey(session.getId());
validate(session, key);
} catch (InvalidSessionException e) {
if (cacheManager != null) {
SimpleSession s = (SimpleSession) session;
if (s.getAttribute(SESSION_USER_KEY) != null)
cacheManager.getCache(null).remove(
s.getAttribute(SESSION_USER_KEY));
}
if (logger.isDebugEnabled()) {
boolean expired = e instanceof ExpiredSessionException;
String msg = (new StringBuilder()).append(
“Invalidated session with id [“).append(
session.getId()).append(“]”).append(
expired ? ” (expired)” : ” (stopped)”)
.toString();
logger.debug(msg);
}
invalidCount++;
}
}
}
if (logger.isInfoEnabled()) {
String msg = “Finished session validation.”;
if (invalidCount > 0)
msg = (new StringBuilder()).append(msg).append(” [“).append(
invalidCount).append(“] sessions were stopped.”)
.toString();
else
msg = (new StringBuilder()).append(msg).append(
” No sessions were stopped.”).toString();
logger.info(msg);
}
}
public void setCacheManager(CacheManager cacheManager) {
this.cacheManager = cacheManager;
}
}
其中这里的方法是校验会话的,方法里加入了cachemanager的接口,然后重写set方法,就能获得实例,然后在执行期间调用cache.remove()方法,就能清空缓存上的信息了;
转载请注明来源网站:blog.ytso.com谢谢！
原创文章，作者：Maggie-Hunter，如若转载，请注明出处：https://blog.ytso.com/tech/pnotes/14762.html