Spring Security在超时时排除URL

Question

在Spring Security中，如何从重置会话超时中排除一个特定的URL？整个应用程序会话超时(server.servlet.seession.timeout(为15分钟。我们有一个来自网页的ajax调用，每1分钟就会调用一次。此调用需要得到保护，但不应影响会话时间。

我们已尝试添加一个扩展ConcurrentSessionFilter的筛选器。此外，还有一个扩展SessionManagementFilter的筛选器。添加ignoring((也会跳过身份验证。没有任何帮助。这个要求能在Spring Security中实现吗？有什么建议吗？

Answer 1

这就是我处理它的方式。只是分享，它可能会对某人有所帮助。请分享一些更好的方法。

Spring Security过滤器作为链中的最后一个添加。

http.addFilterAfter(new SessionInvalidationFilter(timeOutInMinutes), SwitchUserFilter.class);

它跟踪lastUpdatedTime，除了那些需要忽略的URL之外，它会为所有调用更新。如果差异时间大于配置的超时，则会话将无效。

public class SessionInvalidationFilter extends GenericFilterBean {
private static final String LASTUPDATEDDATETIME = "LASTUPDATEDDATETIME";
private static final List<String> ignoredURLs = Arrays.asList("/Notifications/number"); // this is the AJAX URL
private int timeOutInMinutes = 15;
public SessionInvalidationFilter(int timeOutInMinutes) {
this.timeOutInMinutes = timeOutInMinutes;
}
@Override
/**
* LASTUPDATEDDATETIME is updated for all calls except the ignoredURLs.
* Session invalidation happens only during the ignoredURLs calls.
*/
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
HttpSession session = request.getSession(false);
try {
if (session != null && request.getRequestURI() != null) {
if (ignoredURLs.contains(request.getRequestURI())) {
Object lastUpdatedDateTimeObject = session.getAttribute(LASTUPDATEDDATETIME);
if (lastUpdatedDateTimeObject != null) {
LocalDateTime lastUpdatedDateTime = (LocalDateTime) lastUpdatedDateTimeObject;
long timeInMinutes = ChronoUnit.MINUTES.between(lastUpdatedDateTime, LocalDateTime.now());
if (timeInMinutes >= timeOutInMinutes) {
log.info("Timing out sessionID:{}", session.getId());
session.invalidate();
SecurityContextHolder.clearContext();
}
}
} else {
session.setAttribute(LASTUPDATEDDATETIME, LocalDateTime.now());
}
}
} catch (Exception e) {
log.error("Exception in SessionInvalidationFilter", e);
}
chain.doFilter(request, response);
}
}