分布式服务下的session登录问题

馃崙鏃犺鏄崟绯荤粺杩樻槸鍒嗗竷寮忕郴缁燂紝閮戒細娑夊強鍒扮敤鎴风櫥褰曘€佽璇侊紙鎺堟潈銆侀壌鏉冿級銆侀€€鍑虹瓑鍩烘湰鍔熻兘銆備笉鍚屾灦鏋勯噰鐢ㄧ殑鐧诲綍璁よ瘉鏂规鍚勪笉鐩稿悓锛屽父鐢ㄧ殑鏈塩ookie-session銆乼oken銆丣WT绛夈€備竴涓叏鏂扮殑璇锋眰锛屾湇鍔″櫒涓嶇煡閬撳鎴风鐨勫巻鍙茶姹傝褰曪紱Session鍜孋ookie鐨勪富瑕佺洰鐨勬槸涓轰簡寮ヨˉHTTP鐨勬棤鐘舵€佹€с€係ession鏄竴绉嶄紶缁熺殑璁板綍鏈嶅姟鍣ㄥ拰瀹㈡埛绔細璇濈姸鎬佺殑鏈哄埗銆係ession鏄熀浜巆ookie瀹炵幇鐨勩€係ession淇濆瓨鍦ㄦ湇鍔″櫒绔紝sessionId浼氫繚瀛樺湪瀹㈡埛绔殑cookie涓€係ession浼氳瘽涓嶈兘璺ㄨ妭鐐瑰拰鍩熷叡浜€傞渶瑕乺edis绛変腑闂翠欢杈呭姪鍏变韩session鐘舵€侌煃噒okenAccesssToken璁块棶璧勬簮鎺ュ彛锛圓PI锛夋墍闇€鐨勮祫婧愬嚟璇乻impletoken鐨勭粍鎴愶細uid锛堢敤鎴风殑鍞竴鏍囪瘑锛夛紝time锛堝綋鍓嶇殑鏃堕棿鎴筹級time),sign(Signature,token鐨勫墠鍑犱綅閫氳繃鍝堝笇绠楁硶鍘嬬缉鎴愪竴瀹氶暱搴︾殑鍗佸叚杩涘埗瀛楃涓?鍩轰簬Token鐨勭敤鎴疯璇佹槸鏈嶅姟绔殑涓€绉嶆棤鐘舵€佽璇佹柟寮忥紝鏈嶅姟绔笉闇€瑕佸瓨鍌ㄤ护鐗屾暟鎹€傜敤瑙ｆ瀽token鐨勮绠楁椂闂存崲鍙杝ession鐨勫瓨鍌ㄧ┖闂达紝鍑忚交鏈嶅姟鍣ㄥ帇鍔涳紝鍑忓皯棰戠箒鏌ヨ鏁版嵁搴撱€俽efreshtoken鍒锋柊浠ょ墝鏄笓鐢ㄤ簬鍒锋柊璁块棶浠ょ墝鐨勪护鐗屻€傚鏋滄病鏈塺efreshtoken锛宎ccesstoken涔熷彲浠ュ埛鏂帮紝浣嗘槸姣忔鍒锋柊鐢ㄦ埛閮借杈撳叆鐧诲綍鐢ㄦ埛鍚嶅拰瀵嗙爜锛屼細寰堥夯鐑︺€傛湁浜唕efreshtoken灏卞彲浠ュ噺灏戣繖涓夯鐑︼紝瀹㈡埛绔洿鎺ヤ娇鐢╮efreshtoken鏉ユ洿鏂癮ccesstoken锛屼笉闇€瑕佺敤鎴烽澶栨搷浣溿€侫ccessToken鐨勬湁鏁堟湡姣旇緝鐭€傚綋AccesssToken杩囨湡澶辨晥鏃讹紝鍙互閫氳繃RefreshToken鑾峰彇鏂扮殑Token銆傚鏋淩efreshToken涔熷け鏁堬紝鐢ㄦ埛鍙兘閲嶆柊鐧诲綍銆俁efreshToken鍙婂叾杩囨湡鏃堕棿淇濆瓨鍦ㄦ湇鍔″櫒鐨勬暟鎹簱涓紝鍙湁鍦ㄧ敵璇锋柊鐨凙ccesssToken鏃舵墠浼氳繘琛岄獙璇侊紝涓嶄細褰卞搷涓氬姟鎺ュ彛鐨勫搷搴旀椂闂达紝涓嶉渶瑕佸儚浼氳瘽澶勭悊澶ч噺璇㈤棶銆傪煃岼WTJsonWebToken鐨勭缉鍐欐槸JWT锛岄€氬父鍙互绉颁负Jsontoken銆傚畠鏄疪FC7519涓畾涔夌殑涓€绉嶅舰寮忥紝鐢ㄤ簬灏嗕俊鎭綔涓篔son瀵硅薄瀹夊叏鍦颁紶杈撱€傚瓨鍌ㄥ湪JWT涓殑淇℃伅缁忚繃鏁板瓧绛惧悕锛屽洜姝ゅ彲浠ヤ俊浠诲拰鐞嗚В銆傚彲浠ヤ娇鐢℉MAC绠楁硶鎴栦娇鐢≧SA/ECDSA鐨勫叕閽?绉侀挜瀵笿WT杩涜绛惧悕銆侸WT鍦ㄧ嚎鐢熸垚Session锛孞WT銆乀oken閫夋嫨SessionCookies鍙兘鍦ㄥ崟涓妭鐐圭殑鍩熸垨鍏跺瓙鍩熶腑浣跨敤銆傚鏋滀粬浠瘯鍥鹃€氳繃绗笁鏂硅妭鐐硅闂紝浠栦滑灏嗚绂佹銆傚浜庡彧闇€瑕佺櫥褰曠敤鎴峰苟璁块棶瀛樺偍鍦ㄧ珯鐐规暟鎹簱涓殑涓€浜涗俊鎭殑涓皬鍨嬬綉绔欙紝SessionCookies閫氬父灏辫冻澶熶簡銆俿ession-jwt閫夋嫨JWT锛歍oken鍜孭ayload鍔犲瘑淇濆瓨鍦ㄥ鎴风銆傛湇鍔＄鍙渶瑕佷娇鐢ㄥ瘑閽ヨВ瀵嗛獙璇佸嵆鍙紙楠岃瘉涔熸槸JWT鑷繁瀹炵幇鐨勶級銆傛棤闇€鏌ヨ鎴栧噺灏戞煡璇㈡暟鎹簱锛屽洜涓篔WT鑷甫鐢ㄦ埛淇℃伅鍜屽姞瀵嗘暟鎹€俆oken鍜孞WT鐨勫尯鍒細鏈嶅姟绔湪楠岃瘉瀹㈡埛绔彂閫佺殑Token鏃讹紝杩橀渶瑕佹煡璇㈡暟鎹簱鑾峰彇鐢ㄦ埛淇℃伅锛岀劧鍚庨獙璇乀oken鏄惁鏈夋晥銆侸WT鑷甫鐢ㄦ埛淇℃伅鍜屽姞瀵嗘暟瀛楋紝涓嶉渶瑕佹牎楠屻€傚鏋滄偍鏈変紒涓氱骇绔欑偣銆佸簲鐢ㄧ▼搴忔垨闄勮繎鐨勭珯鐐广€佺Щ鍔ㄨ澶囩瓑锛涜€屼綘闇€瑕佸鐞嗗ぇ閲忕殑璇锋眰锛屽挨鍏舵槸绗笁鏂规垨鑰呭緢澶氱涓夋柟锛堝寘鎷綅浜庝笉鍚屽煙鐨凙PI锛夛紝JWT鍜孴oken鏄剧劧鏇撮€傚悎鐞嗚В鏇村馃崒Session鏈夋晥鎬ц缃敱浜庡叧闂祻瑙堝櫒涓嶄細瀵艰嚧session瑕佸垹闄わ紝鏈嶅姟鍣ㄥ繀椤讳负浼氳瘽璁剧疆涓€涓繃鏈熸椂闂淬€傚綋瀹㈡埛绔渶鍚庝竴娆′娇鐢╯ession鐨勬椂闂磋秴杩囦簡杩欎釜杩囨湡鏃堕棿锛屾湇鍔″櫒灏辫涓哄鎴风宸茬粡鍋滄浜嗭紝鍙湁鍦ㄦ病鏈塧ctivity鐨勬儏鍐典笅鎵嶄細鍒犻櫎session锛屼互鑺傜渷瀛樺偍绌洪棿銆傪煃妔pring-sessionSpringSession鎻愪緵浜嗗redis銆乵ongodb銆乵ysql绛夊父鐢ㄥ瓨鍌ㄥ簱鐨勬敮鎸併€係pringSession鎻愪緵浜嗕笌HttpSession鐨勯€忔槑闆嗘垚锛岃繖鎰忓懗鐫€寮€鍙戣€呭彲浠ュ皢HttpSession鐨勫疄鐜颁笌SpringSession鏀寔鐨勫疄鐜拌繘琛屽垏鎹€係pringSession澧炲姞浜嗕竴涓猄essionRepositoryFilter杩囨护鍣ㄦ潵淇敼灏佽璇锋眰鍜屽搷搴斻€傛墦鍖呰姹備负SessionRepositoryRequestWrapper銆傚湪璋冪敤getSession()鏂规硶鏃讹紝瀹為檯涓婃槸鍦ㄨ皟鐢⊿pringSession瀹炵幇鐨勪細璇濄€俿pring-session-sampleSessionRepositoryFilterConfiguration@Configuration(proxyBeanMethods=false)@ConditionalOnBean(SessionRepositoryFilter.class)@EnableConfigurationProperties(SessionProperties.class)绫籗essionRepositoryFilterConfiguration{@BeanFilterRegistrationBean>sessionRepositoryFilterRegistration(Session,SessionRepositoryFilterSessionProperties){@BeanFilterRegistrationBean>>registration=newFilterRegistrationBean<>(filter);registration.setDispatcherTypes(getDispatcherTypes(sessionProperties));registration.setOrder(sessionProperties.getServlet().getFilterOrder());杩斿洖娉ㄥ唽锛泒privateEnumSetgetDispatcherTypes(SessionPropertiessessionProperties){SessionProperties.ServletservletProperties=sessionProperties.getServlet();濡傛灉锛坰ervletProperties.getFilterDispatcherTypes()==null){杩斿洖null;}杩斿洖servletProperties.getFilterDispatcherTypes().stream().map((type)->DispatcherType.valueOf(type.name())).collect(Collectors.collectingAndThen(Collectors.toSet(),EnumSet::copyOf));}}Redis閰嶇疆鍙傝€僐edisSessionConfiguration銆丷edisHttpSessionConfiguration馃崌spring-session閰嶇疆server.servlet.session.timeout=#Session瓒呮椂鏃堕棿銆傚鏋滀笉鎸囧畾duration鍚庣紑锛屽垯浣跨敤绉掋€傦紙鍗曚釜鏈嶅姟鐨剆ession鏈夋晥鏈燂紝鍒嗗竷寮忔湇鍔′笅锛屽鏋滀娇鐢╯pring-session锛屽垯涓哄簳灞傞厤缃級spring.session.redis.flush-mode=on_save#浼氳瘽鍒锋柊妯″紡銆俿pring.session.redis.namespace=spring:session#鐢ㄤ簬瀛樺偍浼氳瘽鐨勯敭鐨勫懡鍚嶇┖闂?spring:session:store-type:redishazelcast:map-name:xxx:admin-v2redis:namespace:xxx:admin-v2:spring:sessiontimeout:86400馃崱Validitysettingtakespricedforsettingthetimeoutofthesessionyoucanusethespring.session.timeout灞炴€с€傚鏋滆灞炴€ф湭浣跨敤servletweb搴旂敤绋嬪簭璁剧疆锛屽垯鑷姩閰嶇疆澶辫触鍥炲埌server.servlet.session.timeout鐨勫€笺€傛偍鍙互浣跨敤@EnableHttpSession锛坰ervlet锛夋垨@EnableWebSession锛堝弽搴斿紡锛夋潵鎺у埗SpringSession鐨勯厤缃€傝繖灏嗗鑷磋嚜鍔ㄩ厤缃€€鍑恒€傜劧鍚庡彲浠ヤ娇鐢ㄦ敞瑙ｇ殑灞炴€ф潵閰嶇疆SpringSession锛岃€屼笉鏄箣鍓嶄粙缁嶇殑閰嶇疆properties銆俿tore-type鏄痳edis@EnableRedisHttpSession>spring.session.timeout>server.servlet.session.timeout鎬荤粨馃崪鏈枃涓昏浠嬬粛login鐨勬妧鏈€夊瀷鍒嗗竷寮忔湇鍔＄被鍨嬩笅鐨勮璇侊紝redis-session鐩稿叧閰嶇疆spring涓嶆劎涓簀ava寮€鍙戜箣鐜嬶紝绋嬪簭鍛樼殑鍦ｇ粡銆傞槄璇绘簮鐮侊紝棰嗘偀缂栫▼鍝插锛岃涓栫晫鏇寸編濂斤紒