Spring Security框架中踢人下线技术探索

<!--Spring Security组件-->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<!--Spring针对Redis操作组件-->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>
<!--Spring Session集成Redis分布式Session会话-->
<dependency>
    <groupId>org.springframework.session</groupId>
    <artifactId>spring-session-data-redis</artifactId>
</dependency>

@SpringBootApplication
@EnableRedisHttpSession(redisNamespace = "fish-admin:session",maxInactiveIntervalInSeconds = 7200)
public class FishAdminApplication {

    static Logger logger= LoggerFactory.getLogger(FishAdminApplication.class);

    public static void main(String[] args) throws UnknownHostException {
        ConfigurableApplicationContext application=SpringApplication.run(FishAdminApplication.class, args);
        Environment env = application.getEnvironment();
        String host= InetAddress.getLocalHost().getHostAddress();
        String port=env.getProperty("server.port");
        logger.info("\n----------------------------------------------------------\n\t" +
                        "Application '{}' is running! Access URLs:\n\t" +
                        "Local: \t\thttp://localhost:{}\n\t" +
                        "External: \thttp://{}:{}\n\t"+
                        "Doc: \thttp://{}:{}/doc.html\n\t"+
                        "----------------------------------------------------------",
                env.getProperty("spring.application.name"),
                env.getProperty("server.port"),
                host,port,
                host,port);
    }

@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.TYPE)
@Documented
@Import(RedisHttpSessionConfiguration.class)
@Configuration(proxyBeanMethods = false)
public @interface EnableRedisHttpSession {
     //more property..   
}

@Bean
public RedisIndexedSessionRepository sessionRepository() {
    RedisTemplate<Object, Object> redisTemplate = createRedisTemplate();
    RedisIndexedSessionRepository sessionRepository = new RedisIndexedSessionRepository(redisTemplate);
    sessionRepository.setApplicationEventPublisher(this.applicationEventPublisher);
    if (this.indexResolver != null) {
        sessionRepository.setIndexResolver(this.indexResolver);
    }
    if (this.defaultRedisSerializer != null) {
        sessionRepository.setDefaultSerializer(this.defaultRedisSerializer);
    }
    sessionRepository.setDefaultMaxInactiveInterval(this.maxInactiveIntervalInSeconds);
    if (StringUtils.hasText(this.redisNamespace)) {
        sessionRepository.setRedisKeyNamespace(this.redisNamespace);
    }
    sessionRepository.setFlushMode(this.flushMode);
    sessionRepository.setSaveMode(this.saveMode);
    int database = resolveDatabase();
    sessionRepository.setDatabase(database);
    this.sessionRepositoryCustomizers
        .forEach((sessionRepositoryCustomizer) -> sessionRepositoryCustomizer.customize(sessionRepository));
    return sessionRepository;
}

@Bean
public RedisMessageListenerContainer springSessionRedisMessageListenerContainer(
    RedisIndexedSessionRepository sessionRepository) {
    RedisMessageListenerContainer container = new RedisMessageListenerContainer();
    container.setConnectionFactory(this.redisConnectionFactory);
    if (this.redisTaskExecutor != null) {
        container.setTaskExecutor(this.redisTaskExecutor);
    }
    if (this.redisSubscriptionExecutor != null) {
        container.setSubscriptionExecutor(this.redisSubscriptionExecutor);
    }
    container.addMessageListener(sessionRepository,
                                 Arrays.asList(new ChannelTopic(sessionRepository.getSessionDeletedChannel()),
                                               new ChannelTopic(sessionRepository.getSessionExpiredChannel())));
    container.addMessageListener(sessionRepository,
                                 Collections.singletonList(new PatternTopic(sessionRepository.getSessionCreatedChannelPrefix() + "*")));
    return container;
}

public interface SessionRepository<S extends Session> {

 /**
  * Creates a new {@link Session} that is capable of being persisted by this
  * {@link SessionRepository}.
  *
  * <p>
  * This allows optimizations and customizations in how the {@link Session} is
  * persisted. For example, the implementation returned might keep track of the changes
  * ensuring that only the delta needs to be persisted on a save.
  * </p>
  * @return a new {@link Session} that is capable of being persisted by this
  * {@link SessionRepository}
  */
 S createSession();

 /**
  * Ensures the {@link Session} created by
  * {@link org.springframework.session.SessionRepository#createSession()} is saved.
  *
  * <p>
  * Some implementations may choose to save as the {@link Session} is updated by
  * returning a {@link Session} that immediately persists any changes. In this case,
  * this method may not actually do anything.
  * </p>
  * @param session the {@link Session} to save
  */
 void save(S session);

 /**
  * Gets the {@link Session} by the {@link Session#getId()} or null if no
  * {@link Session} is found.
  * @param id the {@link org.springframework.session.Session#getId()} to lookup
  * @return the {@link Session} by the {@link Session#getId()} or null if no
  * {@link Session} is found.
  */
 S findById(String id);

 /**
  * Deletes the {@link Session} with the given {@link Session#getId()} or does nothing
  * if the {@link Session} is not found.
  * @param id the {@link org.springframework.session.Session#getId()} to delete
  */
 void deleteById(String id);

}

public interface FindByIndexNameSessionRepository<S extends Session> extends SessionRepository<S> {

 /**
  * 当前存储的用户名前缀，使用Redis进行存储时，存储的key值是:redisNamespace+
  */
 String PRINCIPAL_NAME_INDEX_NAME = FindByIndexNameSessionRepository.class.getName()
   .concat(".PRINCIPAL_NAME_INDEX_NAME");

 /**
  * Find a {@link Map} of the session id to the {@link Session} of all sessions that
  * contain the specified index name index value.
  * @param indexName the name of the index (i.e.
  * {@link FindByIndexNameSessionRepository#PRINCIPAL_NAME_INDEX_NAME})
  * @param indexValue the value of the index to search for.
  * @return a {@code Map} (never {@code null}) of the session id to the {@code Session}
  * of all sessions that contain the specified index name and index value. If no
  * results are found, an empty {@code Map} is returned.
  */
 Map<String, S> findByIndexNameAndIndexValue(String indexName, String indexValue);

 /**
  * Find a {@link Map} of the session id to the {@link Session} of all sessions that
  * contain the index with the name
  * {@link FindByIndexNameSessionRepository#PRINCIPAL_NAME_INDEX_NAME} and the
  * specified principal name.
  * @param principalName the principal name
  * @return a {@code Map} (never {@code null}) of the session id to the {@code Session}
  * of all sessions that contain the specified principal name. If no results are found,
  * an empty {@code Map} is returned.
  * @since 2.1.0
  */
 default Map<String, S> findByPrincipalName(String principalName) {

  return findByIndexNameAndIndexValue(PRINCIPAL_NAME_INDEX_NAME, principalName);

 }

}

@Override
public Map<String, RedisSession> findByIndexNameAndIndexValue(String indexName, String indexValue) {
    //如果名称不匹配，则直接反馈空集合Map
    if (!PRINCIPAL_NAME_INDEX_NAME.equals(indexName)) {
        return Collections.emptyMap();
    }
    //获取拼装的Key值
    String principalKey = getPrincipalKey(indexValue);
    //从Redis中获取该Key值的成员数
    Set<Object> sessionIds = this.sessionRedisOperations.boundSetOps(principalKey).members();
    //初始化Map集合
    Map<String, RedisSession> sessions = new HashMap<>(sessionIds.size());
    //循环遍历
    for (Object id : sessionIds) {
        //根据id查找Session会话
        RedisSession session = findById((String) id);
        if (session != null) {
            sessions.put(session.getId(), session);
        }
    }
    return sessions;
}

String getPrincipalKey(String principalName) {
    return this.namespace + "index:" + FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME + ":"
        + principalName;
}

@Override
public void deleteById(String sessionId) {
    //根据sessionId获取Session会话
    RedisSession session = getSession(sessionId, true);
    if (session == null) {
        return;
    }
 //从Redis中移除所有存储的针对principal的key值
    cleanupPrincipalIndex(session);
    //Redis中删除SessionId所对应的key值
    this.expirationPolicy.onDelete(session);
    //移除Session会话创建时，存储的过期key值
    String expireKey = getExpiredKey(session.getId());
    this.sessionRedisOperations.delete(expireKey);
    //设置当前session会话最大存活时间为0
    session.setMaxInactiveInterval(Duration.ZERO);
    //执行save方法
    save(session);
}

@Override
public void onMessage(Message message, byte[] pattern) {
    byte[] messageChannel = message.getChannel();
    byte[] messageBody = message.getBody();

    String channel = new String(messageChannel);

    if (channel.startsWith(this.sessionCreatedChannelPrefix)) {
        // TODO: is this thread safe?
        @SuppressWarnings("unchecked")
        Map<Object, Object> loaded = (Map<Object, Object>) this.defaultSerializer.deserialize(message.getBody());
        handleCreated(loaded, channel);
        return;
    }

    String body = new String(messageBody);
    if (!body.startsWith(getExpiredKeyPrefix())) {
        return;
    }

    boolean isDeleted = channel.equals(this.sessionDeletedChannel);
    if (isDeleted || channel.equals(this.sessionExpiredChannel)) {
        int beginIndex = body.lastIndexOf(":") + 1;
        int endIndex = body.length();
        String sessionId = body.substring(beginIndex, endIndex);

        RedisSession session = getSession(sessionId, true);

        if (session == null) {
            logger.warn("Unable to publish SessionDestroyedEvent for session " + sessionId);
            return;
        }

        if (logger.isDebugEnabled()) {
            logger.debug("Publishing SessionDestroyedEvent for session " + sessionId);
        }

        cleanupPrincipalIndex(session);

        if (isDeleted) {
            handleDeleted(session);
        }
        else {
            handleExpired(session);
        }
    }
}

private void handleDeleted(RedisSession session) {
  publishEvent(new SessionDeletedEvent(this, session));
}

private void handleExpired(RedisSession session) {
    publishEvent(new SessionExpiredEvent(this, session));
}

private void publishEvent(ApplicationEvent event) {
    try {
        this.eventPublisher.publishEvent(event);
    }
    catch (Throwable ex) {
        logger.error("Error publishing " + event + ".", ex);
    }
}

@Component
public class SecuritySessionEventListener {

    @EventListener
    public void sessionDestroyed(SessionDestroyedEvent event) {
        //session销毁事件处理方法...
    }

    @EventListener
    public void sessionCreated(SessionCreatedEvent event) {
        //session创建会话事件处理方法...
    }

    @EventListener
    public void sessionExired(SessionExpiredEvent event) {
        //session会话过期事件处理方法...
    }
}

public interface SessionService {

    /**
     *
     * @param account
     * @return
     */
    boolean hasLogin(String account);

    /**
     * 根據账号查找当前session会话
     * @param account 账号
     * @return
     */
    Map<String, ? extends Session> loadByAccount(String account);

    /**
     * 销毁当前session会话
     * @param account
     */
    void destroySession(String account);
}

/**
 * SpringSession集成底层Redis实现，如果底层分布式会话保持方式不是基于Redis,则该类无法正常使用
 * @author <a href="mailto:xiaoymin@foxmail.com">xiaoymin@foxmail.com</a>
 * 2021/04/20 16:23
 * @since:fish 1.0
 */
public class RedisSessionService implements SessionService {

    Logger logger= LoggerFactory.getLogger(RedisSessionService.class);

    final RedisIndexedSessionRepository redisIndexedSessionRepository;

    final ApplicationEventPublisher applicationEventPublisher;

    public RedisSessionService(RedisIndexedSessionRepository redisIndexedSessionRepository, ApplicationEventPublisher applicationEventPublisher) {
        this.redisIndexedSessionRepository = redisIndexedSessionRepository;
        this.applicationEventPublisher = applicationEventPublisher;
    }


    @Override
    public boolean hasLogin(String account) {
        return CollectionUtil.isNotEmpty(loadByAccount(account));
    }

    @Override
    public Map<String, ? extends Session> loadByAccount(String account) {
        logger.info("收集当前登录会话session，账号:{}",account);
        return redisIndexedSessionRepository.findByIndexNameAndIndexValue(FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME,account);
    }

    @Override
    public void destroySession(String account) {
        logger.info("销毁当前登录session会话,账号：{}",account);
        Map<String,? extends Session> sessionMap=loadByAccount(account);
        if (CollectionUtil.isNotEmpty(sessionMap)){
            logger.info("当前登录会话size:{}",sessionMap.size());
            for (Map.Entry<String,? extends Session> sessionEntry:sessionMap.entrySet()){
                String key=sessionEntry.getKey();
                Session session=sessionEntry.getValue();
                logger.info("destroy session key:{}",key);
                //删除
                redisIndexedSessionRepository.deleteById(session.getId());
                //广播Session会话销毁事件
                applicationEventPublisher.publishEvent(new SessionDestroyedEvent(redisIndexedSessionRepository,session));
            }
        }
    }
}

@Bean
public RedisSessionService sessionService(RedisIndexedSessionRepository redisIndexedSessionRepository, ApplicationEventPublisher applicationEventPublisher){
    return new RedisSessionService(redisIndexedSessionRepository,applicationEventPublisher);
}

/**
* 根据主键id删除用户管理
* @param id 主键id
* @return 是否删除成功
*/
@Override
public RestfulMessage<String> delete(Integer id) {
    logger.info("根据主键id删除用户管理,id:{}",id);
    FishUserInfo fishUserInfo=fishUserInfoMapper.selectByPrimaryKey(id);
    assertArgumentNotEmpty(fishUserInfo,"请求数据非法");
    int ret=fishUserInfoMapper.deleteByPrimaryKey(id);
    //删除成功，如果该角色在线，则强制剔除下线
    if (ret>0){
        logger.info("用户会话剔除下线");
        sessionService.destroySession(fishUserInfo.getAccount());
    }
    return ret>0?RestfulMessage.success("删除成功"):RestfulMessage.error("删除失败");
}