Spring Security 6.x 一文讲透Session认证管理机制

public abstract class ManagerBase extends LifecycleMBeanBase implements Manager {
    ...
    protected Map<String,Session> sessions = new ConcurrentHashMap<>();
    ...
    
    @Override
    public Session findSession(String id) throws IOException {
        if (id == null) {
            return null;
        }
        return sessions.get(id);
    }
    
        @Override
    public void add(Session session) {
        sessions.put(session.getIdInternal(), session);
        int size = getActiveSessions();
        if (size > maxActive) {
            synchronized (maxActiveUpdateLock) {
                if (size > maxActive) {
                    maxActive = size;
                }
            }
        }
    }
    
    @Override
    public Session createSession(String sessionId) {
    
        if ((maxActiveSessions >= 0) && (getActiveSessions() >= maxActiveSessions)) {
            rejectedSessions++;
            throw new TooManyActiveSessionsException(sm.getString("managerBase.createSession.ise"), maxActiveSessions);
        }
    
        // Recycle or create a Session instance
        Session session = createEmptySession();
    
        // Initialize the properties of the new session and return it
        session.setNew(true);
        session.setValid(true);
        session.setCreationTime(System.currentTimeMillis());
        session.setMaxInactiveInterval(getContext().getSessionTimeout() * 60);
        String id = sessionId;
        if (id == null) {
            id = generateSessionId();
        }
        session.setId(id); // 该方法内，会调用上面的add方法，将该session保存到ConcurrentHashMap中
    
        SessionTiming timing = new SessionTiming(session.getCreationTime(), 0);
        synchronized (sessionCreationTiming) {
            sessionCreationTiming.add(timing);
            sessionCreationTiming.poll();
        }
        return session;
    }
}

@Override
public HttpSession getSession(boolean create) {
    Session session = doGetSession(create);
    if (session == null) {
        return null;
    }

    return session.getSession(); // 门面模式，把session自身封装到StandardSessionFacade对象中返回，StandardSessionFacade是HttpSession接口在Tomcat中的实现类
}

protected Session doGetSession(boolean create) {
    Context context = getContext();
    ...
    Manager manager = context.getManager();
    ...
    if (requestedSessionId != null) { // 从Cookie JSESSIONID中解析出来的sessionId，也有可能为null
        try {
            session = manager.findSession(requestedSessionId); // 在manager中的ConcurrentHashMap查找
        } catch (IOException e) {
           ...
        }
        ...
        if (session != null) {
            session.access(); // 记录该session的访问次数
            return session;
        }
    }

    // Create a new session if requested and the response is not committed
    if (!create) {
        return null;
    }
    ...
    String sessionId = getRequestedSessionId(); 
    ...
    session = manager.createSession(sessionId); // 创建新的Session
    // Creating a new session cookie based on that session
    if (session != null && trackModesIncludesCookie) {
        Cookie cookie =
                ApplicationSessionCookieConfig.createSessionCookie(context, session.getIdInternal(), isSecure()); // 这里会创建一个名为"JSESSIONID"的Cookie
        response.addSessionCookieInternal(cookie);
    }

    if (session == null) {
        return null;
    }

    session.access();
    return session;
}

@Override
public void saveContext(SecurityContext context, HttpServletRequest request, HttpServletResponse response) {
    SaveContextOnUpdateOrErrorResponseWrapper responseWrapper = WebUtils.getNativeResponse(response,
          SaveContextOnUpdateOrErrorResponseWrapper.class);
    if (responseWrapper == null) {
       saveContextInHttpSession(context, request); // 通常执行这个方法
       return;
    }
    responseWrapper.saveContext(context);
}

private void saveContextInHttpSession(SecurityContext context, HttpServletRequest request) {
    if (isTransient(context) || isTransient(context.getAuthentication())) {
       return;
    }
    SecurityContext emptyContext = generateNewContext();
    if (emptyContext.equals(context)) {
       HttpSession session = request.getSession(false);
       removeContextFromSession(context, session);
    }
    else {
       boolean createSession = this.allowSessionCreation;
       HttpSession session = request.getSession(createSession);
       setContextInSession(context, session);
    }
}

private void setContextInSession(SecurityContext context, HttpSession session) {
    if (session != null) {
       session.setAttribute(this.springSecurityContextKey, context); //将SecurityContext对象，保存在session的属性中，其中springSecurityContextKey默认值为"SPRING_SECURITY_CONTEXT_KEY"
       if (this.logger.isDebugEnabled()) {
          this.logger.debug(LogMessage.format("Stored %s to HttpSession [%s]", context, session));
       }
    }
}

private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
       throws ServletException, IOException {
    if (request.getAttribute(FILTER_APPLIED) != null) {
       chain.doFilter(request, response);
       return;
    }
    request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
    Supplier<SecurityContext> deferredContext = this.securityContextRepository.loadDeferredContext(request);
    try {
       this.securityContextHolderStrategy.setDeferredContext(deferredContext);
       chain.doFilter(request, response);
    }
    finally {
       this.securityContextHolderStrategy.clearContext();
       request.removeAttribute(FILTER_APPLIED);
    }
}

public DeferredSecurityContext loadDeferredContext(HttpServletRequest request) {
    Supplier<SecurityContext> supplier = () -> readSecurityContextFromSession(request.getSession(false));
    return new SupplierDeferredSecurityContext(supplier, this.securityContextHolderStrategy);
}

private SecurityContext readSecurityContextFromSession(HttpSession httpSession) {
    if (httpSession == null) {
       this.logger.trace("No HttpSession currently exists");
       return null;
    }
    // Session exists, so try to obtain a context from it.
    Object contextFromSession = httpSession.getAttribute(this.springSecurityContextKey); //通过springSecurityContextKey获取session对应的属性值，并通过类型转换得到SecurityContext对象
   ...
    // Everything OK. The only non-null return from this method.
    return (SecurityContext) contextFromSession;
}

private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
       throws IOException, ServletException {
    ...
    HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request, response);
    SecurityContext contextBeforeChainExecution = this.repo.loadContext(holder);
    try {
       this.securityContextHolderStrategy.setContext(contextBeforeChainExecution);
      ...
       chain.doFilter(holder.getRequest(), holder.getResponse());
    }
    finally {
       SecurityContext contextAfterChainExecution = this.securityContextHolderStrategy.getContext();
       // Crucial removal of SecurityContextHolder contents before anything else.
       this.securityContextHolderStrategy.clearContext();
       this.repo.saveContext(contextAfterChainExecution, holder.getRequest(), holder.getResponse()); // 在SecurityContextHolderFilter中，不再自动保存SecurityContext
       request.removeAttribute(FILTER_APPLIED);
       this.logger.debug("Cleared SecurityContextHolder to complete request");
    }
}

private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
       throws IOException, ServletException {
    ...
    Authentication rememberMeAuth = this.rememberMeServices.autoLogin(request, response);
    if (rememberMeAuth != null) {
       // Attempt authentication via AuthenticationManager
       try {
          rememberMeAuth = this.authenticationManager.authenticate(rememberMeAuth);
          // Store to SecurityContextHolder
      SecurityContext context = SecurityContextHolder.createEmptyContext();
          context.setAuthentication(rememberMeAuth);
      SecurityContextHolder.setContext(context);
          onSuccessfulAuthentication(request, response, rememberMeAuth);
          // this.securityContextRepository.saveContext(context, request, response); 在Spring Security 5.7及更高版本，增加了保存SecurityContext的步骤
          ...
       }
       catch (AuthenticationException ex) {
          ...
       }
    }
    chain.doFilter(request, response);
}

public class SessionInformation implements Serializable {
    ...
    private Date lastRequest; // 最近访问时间，每次发起请求时，如果当前Session还未失效，则刷新该时间
    private final Object principal; // 标识当前用户，通常就是用户名
    private final String sessionId; // 对应HttpSession的sessionId
    private boolean expired = false; // 标识当前session是否过期
    ...    
}

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    ...
    http.sessionManagement(session -> session.sessionConcurrency(concurrency -> concurrency.maximumSessions(1)));
    ...
    return http.build();
}

public void onAuthentication(Authentication authentication, HttpServletRequest request,
       HttpServletResponse response) {
    int allowedSessions = getMaximumSessionsForThisUser(authentication);
    if (allowedSessions == -1) { // maximumSessions为-1时，则表示不限制session数量
       // We permit unlimited logins
       return;
    }
    List<SessionInformation> sessions = this.sessionRegistry.getAllSessions(authentication.getPrincipal(), false);
    int sessionCount = sessions.size();
    if (sessionCount < allowedSessions) {
       // They haven't got too many login sessions running at present
       return;
    }
    if (sessionCount == allowedSessions) { // 如果该用户所有的sessionInformation数量恰好等于maximumSessions，则判断当前session的id是否包含在这些sessionInformation，如没有，则表示该session需要被失效
       HttpSession session = request.getSession(false);
       if (session != null) {
          // Only permit it though if this request is associated with one of the
          // already registered sessions
          for (SessionInformation si : sessions) {
             if (si.getSessionId().equals(session.getId())) {
                return;
             }
          }
       }
       // If the session is null, a new one will be created by the parent class,
       // exceeding the allowed number
    }
    allowableSessionsExceeded(sessions, allowedSessions, this.sessionRegistry);
}

protected void allowableSessionsExceeded(List<SessionInformation> sessions, int allowableSessions,
       SessionRegistry registry) throws SessionAuthenticationException {
    if (this.exceptionIfMaximumExceeded || (sessions == null)) {
       throw new SessionAuthenticationException(
             this.messages.getMessage("ConcurrentSessionControlAuthenticationStrategy.exceededAllowed",
                   new Object[] { allowableSessions }, "Maximum sessions of {0} for this principal exceeded"));
    }
    // Determine least recently used sessions, and mark them for invalidation
    sessions.sort(Comparator.comparing(SessionInformation::getLastRequest));
    int maximumSessionsExceededBy = sessions.size() - allowableSessions + 1;
    List<SessionInformation> sessionsToBeExpired = sessions.subList(0, maximumSessionsExceededBy);
    for (SessionInformation session : sessionsToBeExpired) {
       session.expireNow();
    }
}

private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
       throws IOException, ServletException {
    HttpSession session = request.getSession(false);
    if (session != null) {
       SessionInformation info = this.sessionRegistry.getSessionInformation(session.getId());
       if (info != null) {
          if (info.isExpired()) {
             // Expired - abort processing
             this.logger.debug(LogMessage
                .of(() -> "Requested session ID " + request.getRequestedSessionId() + " has expired."));
             doLogout(request, response); // sessionInformation被标记为已过期，执行登出逻辑，以及过期策略
             this.sessionInformationExpiredStrategy
                .onExpiredSessionDetected(new SessionInformationExpiredEvent(info, request, response)); //默认实现为ResponseBodySessionInformationExpiredStrategy，它向Response写了一段告知用户session已过期的文字
             return;
          }
          // Non-expired - update last request date/time
          this.sessionRegistry.refreshLastRequest(info.getSessionId()); // 对于未过期的session，则更新其lastRequest时间
       }
    }
    chain.doFilter(request, response);
}

public class RegisterSessionAuthenticationStrategy implements SessionAuthenticationStrategy {

    private final SessionRegistry sessionRegistry;

    ...
    @Override
    public void onAuthentication(Authentication authentication, HttpServletRequest request,
          HttpServletResponse response) {
       this.sessionRegistry.registerNewSession(request.getSession().getId(), authentication.getPrincipal());
    }

}

public class SessionRegistryImpl implements SessionRegistry, ApplicationListener<AbstractSessionEvent> {
    ...
    private final ConcurrentMap<Object, Set<String>> principals;

    private final Map<String, SessionInformation> sessionIds;
    ...
    @Override
    public void registerNewSession(String sessionId, Object principal) {
       ...
        if (getSessionInformation(sessionId) != null) {
           removeSessionInformation(sessionId);
        }
       ...
        this.sessionIds.put(sessionId, new SessionInformation(principal, sessionId, new Date()));
        this.principals.compute(principal, (key, sessionsUsedByPrincipal) -> {
           if (sessionsUsedByPrincipal == null) {
              sessionsUsedByPrincipal = new CopyOnWriteArraySet<>();
           }
           sessionsUsedByPrincipal.add(sessionId);
           this.logger.trace(LogMessage.format("Sessions used by '%s' : %s", principal, sessionsUsedByPrincipal));
           return sessionsUsedByPrincipal;
        });
    }
}

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    ...
    http.sessionManagement(session -> session.sessionFixation(fixation -> fixation.changeSessionId()));
    http.sessionManagement(session -> session.sessionFixation(fixation -> fixation.newSession()));
    http.sessionManagement(session -> session.sessionFixation(fixation -> fixation.migrateSession()));
    ...
    return http.build();
}

public final class ChangeSessionIdAuthenticationStrategy extends AbstractSessionFixationProtectionStrategy {

    @Override
    HttpSession applySessionFixation(HttpServletRequest request) {
       request.changeSessionId();
       return request.getSession();
    }

}

final HttpSession applySessionFixation(HttpServletRequest request) {
    HttpSession session = request.getSession();
    String originalSessionId = session.getId();
    this.logger.debug(LogMessage.of(() -> "Invalidating session with Id '" + originalSessionId + "' "
          + (this.migrateSessionAttributes ? "and" : "without") + " migrating attributes."));
    Map<String, Object> attributesToMigrate = extractAttributes(session);
    int maxInactiveIntervalToMigrate = session.getMaxInactiveInterval();
    session.invalidate();
    session = request.getSession(true); // we now have a new session
    this.logger.debug(LogMessage.format("Started new session: %s", session.getId()));
    transferAttributes(attributesToMigrate, session);
    if (this.migrateSessionAttributes) {
       session.setMaxInactiveInterval(maxInactiveIntervalToMigrate);
    }
    return session;
}