blocks|key|1207292|text|实际上，您可以通过执行以下操作来访问会话中的信息，即使HttpSessionLisener上的会话正在被破坏：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1207293|public+void+sessionDestroyed(HttpSessionEvent+hse)+{
++++SecurityContextImpl+sci+=+(SecurityContextImpl)+hse.getSession().getAttribute("SPRING_SECURITY_CONTEXT");
++++//+be+sure+to+check+is+not+null+since+for+users+who+just+get+into+the+home+page+but+never+get+authenticated+it+will+be
++++if+(sci+!=+null)+{
++++++++UserDetails+cud+=+(UserDetails)+sci.getAuthentication().getPrincipal();
++++++++//+do+whatever+you+need+here+with+the+UserDetails
++++}
+}|code-block|syntax|javascript|1207294|或者，您也可以在HttpSession对象可用的任何地方访问信息，如下所示：|1207295|SecurityContextImpl+sci+=+(SecurityContextImpl)+session().getAttribute("SPRING_SECURITY_CONTEXT");|1207296|最后一种假设你有类似的东西：|1207297|HttpSession+sesssion+=+...;+//+can+come+from+request.getSession(false);|1207298|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|S|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|U|8|@]|9|@]|A|$]]|$1|M|3|N|5|D|7|V|8|@]|9|@]|A|$E|F]]|$1|O|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|P|$]]

Indeed you can access the information from the session even when the session is being destroyed on an HttpSessionLisener by doing: 

<pre><code>public void sessionDestroyed(HttpSessionEvent hse) {
 SecurityContextImpl sci = (SecurityContextImpl) hse.getSession().getAttribute("SPRING_SECURITY_CONTEXT");
 // be sure to check is not null since for users who just get into the home page but never get authenticated it will be
 if (sci != null) {
 UserDetails cud = (UserDetails) sci.getAuthentication().getPrincipal();
 // do whatever you need here with the UserDetails
 }
 }
</code></pre>

or you could also access the information anywhere you have the HttpSession object available like:

<pre><code>SecurityContextImpl sci = (SecurityContextImpl) session().getAttribute("SPRING_SECURITY_CONTEXT");
</code></pre>

the last assuming you have something like:

<pre><code>HttpSession sesssion = ...; // can come from request.getSession(false);
</code></pre>

blocks|key|1207348|text|我做了我自己的工具。这很方便。:)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1207349|package+samples.utils;

import+java.util.Arrays;
import+java.util.Collection;
import+java.util.Locale;

import+javax.servlet.ServletContext;
import+javax.servlet.http.HttpServletRequest;
import+javax.servlet.http.HttpSession;
import+javax.sql.DataSource;

import+org.slf4j.Logger;
import+org.slf4j.LoggerFactory;
import+org.springframework.beans.factory.NoSuchBeanDefinitionException;
import+org.springframework.beans.factory.NoUniqueBeanDefinitionException;
import+org.springframework.context.ApplicationContext;
import+org.springframework.context.ApplicationEventPublisher;
import+org.springframework.context.MessageSource;
import+org.springframework.core.convert.ConversionService;
import+org.springframework.core.io.ResourceLoader;
import+org.springframework.core.io.support.ResourcePatternResolver;
import+org.springframework.ui.context.Theme;
import+org.springframework.util.ClassUtils;
import+org.springframework.web.context.request.RequestContextHolder;
import+org.springframework.web.context.request.ServletRequestAttributes;
import+org.springframework.web.context.support.WebApplicationContextUtils;
import+org.springframework.web.servlet.LocaleResolver;
import+org.springframework.web.servlet.ThemeResolver;
import+org.springframework.web.servlet.support.RequestContextUtils;


/**
+*+SpringMVC通用工具
+*+
+*+@author+应卓(yingzhor@gmail.com)
+*
+*/
public+final+class+WebContextHolder+{

++++private+static+final+Logger+LOGGER+=+LoggerFactory.getLogger(WebContextHolder.class);

++++private+static+WebContextHolder+INSTANCE+=+new+WebContextHolder();

++++public+WebContextHolder+get()+{
++++++++return+INSTANCE;
++++}

++++private+WebContextHolder()+{
++++++++super();
++++}

++++//+--------------------------------------------------------------------------------------------------------------

++++public+HttpServletRequest+getRequest()+{
++++++++ServletRequestAttributes+attributes+=+(ServletRequestAttributes)+RequestContextHolder.currentRequestAttributes();
++++++++return+attributes.getRequest();
++++}

++++public+HttpSession+getSession()+{
++++++++return+getSession(true);
++++}

++++public+HttpSession+getSession(boolean+create)+{
++++++++return+getRequest().getSession(create);
++++}

++++public+String+getSessionId()+{
++++++++return+getSession().getId();
++++}

++++public+ServletContext+getServletContext()+{
++++++++return+getSession().getServletContext();++++//+servlet2.3
++++}

++++public+Locale+getLocale()+{
++++++++return+RequestContextUtils.getLocale(getRequest());
++++}

++++public+Theme+getTheme()+{
++++++++return+RequestContextUtils.getTheme(getRequest());
++++}

++++public+ApplicationContext+getApplicationContext()+{
++++++++return+WebApplicationContextUtils.getWebApplicationContext(getServletContext());
++++}

++++public+ApplicationEventPublisher+getApplicationEventPublisher()+{
++++++++return+(ApplicationEventPublisher)+getApplicationContext();
++++}

++++public+LocaleResolver+getLocaleResolver()+{
++++++++return+RequestContextUtils.getLocaleResolver(getRequest());
++++}

++++public+ThemeResolver+getThemeResolver()+{
++++++++return+RequestContextUtils.getThemeResolver(getRequest());
++++}

++++public+ResourceLoader+getResourceLoader()+{
++++++++return+(ResourceLoader)+getApplicationContext();
++++}

++++public+ResourcePatternResolver+getResourcePatternResolver()+{
++++++++return+(ResourcePatternResolver)+getApplicationContext();
++++}

++++public+MessageSource+getMessageSource()+{
++++++++return+(MessageSource)+getApplicationContext();
++++}

++++public+ConversionService+getConversionService()+{
++++++++return+getBeanFromApplicationContext(ConversionService.class);
++++}

++++public+DataSource+getDataSource()+{
++++++++return+getBeanFromApplicationContext(DataSource.class);
++++}

++++public+Collection<String>+getActiveProfiles()+{
++++++++return+Arrays.asList(getApplicationContext().getEnvironment().getActiveProfiles());
++++}

++++public+ClassLoader+getBeanClassLoader()+{
++++++++return+ClassUtils.getDefaultClassLoader();
++++}

++++private+<T>+T+getBeanFromApplicationContext(Class<T>+requiredType)+{
++++++++try+{
++++++++++++return+getApplicationContext().getBean(requiredType);
++++++++}+catch+(NoUniqueBeanDefinitionException+e)+{
++++++++++++LOGGER.error(e.getMessage(),+e);
++++++++++++throw+e;
++++++++}+catch+(NoSuchBeanDefinitionException+e)+{
++++++++++++LOGGER.warn(e.getMessage());
++++++++++++return+null;
++++++++}
++++}

}|code-block|syntax|javascript|1207350|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

i made my own utils. it is handy. :)

<pre><code>package samples.utils;

import java.util.Arrays;
import java.util.Collection;
import java.util.Locale;

import javax.servlet.ServletContext;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
import javax.sql.DataSource;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.NoSuchBeanDefinitionException;
import org.springframework.beans.factory.NoUniqueBeanDefinitionException;
import org.springframework.context.ApplicationContext;
import org.springframework.context.ApplicationEventPublisher;
import org.springframework.context.MessageSource;
import org.springframework.core.convert.ConversionService;
import org.springframework.core.io.ResourceLoader;
import org.springframework.core.io.support.ResourcePatternResolver;
import org.springframework.ui.context.Theme;
import org.springframework.util.ClassUtils;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import org.springframework.web.context.support.WebApplicationContextUtils;
import org.springframework.web.servlet.LocaleResolver;
import org.springframework.web.servlet.ThemeResolver;
import org.springframework.web.servlet.support.RequestContextUtils;


/**
 * SpringMVC通用工具
 * 
 * @author 应卓(yingzhor@gmail.com)
 *
 */
public final class WebContextHolder {

 private static final Logger LOGGER = LoggerFactory.getLogger(WebContextHolder.class);

 private static WebContextHolder INSTANCE = new WebContextHolder();

 public WebContextHolder get() {
 return INSTANCE;
 }

 private WebContextHolder() {
 super();
 }

 // --------------------------------------------------------------------------------------------------------------

 public HttpServletRequest getRequest() {
 ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.currentRequestAttributes();
 return attributes.getRequest();
 }

 public HttpSession getSession() {
 return getSession(true);
 }

 public HttpSession getSession(boolean create) {
 return getRequest().getSession(create);
 }

 public String getSessionId() {
 return getSession().getId();
 }

 public ServletContext getServletContext() {
 return getSession().getServletContext(); // servlet2.3
 }

 public Locale getLocale() {
 return RequestContextUtils.getLocale(getRequest());
 }

 public Theme getTheme() {
 return RequestContextUtils.getTheme(getRequest());
 }

 public ApplicationContext getApplicationContext() {
 return WebApplicationContextUtils.getWebApplicationContext(getServletContext());
 }

 public ApplicationEventPublisher getApplicationEventPublisher() {
 return (ApplicationEventPublisher) getApplicationContext();
 }

 public LocaleResolver getLocaleResolver() {
 return RequestContextUtils.getLocaleResolver(getRequest());
 }

 public ThemeResolver getThemeResolver() {
 return RequestContextUtils.getThemeResolver(getRequest());
 }

 public ResourceLoader getResourceLoader() {
 return (ResourceLoader) getApplicationContext();
 }

 public ResourcePatternResolver getResourcePatternResolver() {
 return (ResourcePatternResolver) getApplicationContext();
 }

 public MessageSource getMessageSource() {
 return (MessageSource) getApplicationContext();
 }

 public ConversionService getConversionService() {
 return getBeanFromApplicationContext(ConversionService.class);
 }

 public DataSource getDataSource() {
 return getBeanFromApplicationContext(DataSource.class);
 }

 public Collection&lt;String&gt; getActiveProfiles() {
 return Arrays.asList(getApplicationContext().getEnvironment().getActiveProfiles());
 }

 public ClassLoader getBeanClassLoader() {
 return ClassUtils.getDefaultClassLoader();
 }

 private &lt;T&gt; T getBeanFromApplicationContext(Class&lt;T&gt; requiredType) {
 try {
 return getApplicationContext().getBean(requiredType);
 } catch (NoUniqueBeanDefinitionException e) {
 LOGGER.error(e.getMessage(), e);
 throw e;
 } catch (NoSuchBeanDefinitionException e) {
 LOGGER.warn(e.getMessage());
 return null;
 }
 }

}
</code></pre>

blocks|key|1207359|text|我尝试使用next代码，效果非常好|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1207360|++++import+org.springframework.security.core.Authentication;
++++import+org.springframework.security.core.context.SecurityContextHolder;
++++import+org.springframework.stereotype.Controller;
++++import+org.springframework.ui.ModelMap;
++++import+org.springframework.web.bind.annotation.RequestMapping;
++++import+org.springframework.web.bind.annotation.RequestMethod;

++++/**
+++++*+Created+by+jaime+on+14/01/15.
+++++*/

++++@Controller
++++public+class+obteinUserSession+{
++++++++@RequestMapping(value+=+"/loginds",+method+=+RequestMethod.GET)
++++++++public+String+UserSession(ModelMap+modelMap)+{
++++++++++++Authentication+auth+=+SecurityContextHolder.getContext().getAuthentication();
++++++++++++String+name+=+auth.getName();
++++++++++++modelMap.addAttribute("username",+name);
++++++++++++return+"hellos+"+%2B+name;
++++++++}|code-block|syntax|javascript|1207361|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

I try with next code and work excellent 

<pre><code> import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;

 /**
 * Created by jaime on 14/01/15.
 */

 @Controller
 public class obteinUserSession {
 @RequestMapping(value = "/loginds", method = RequestMethod.GET)
 public String UserSession(ModelMap modelMap) {
 Authentication auth = SecurityContextHolder.getContext().getAuthentication();
 String name = auth.getName();
 modelMap.addAttribute("username", name);
 return "hellos " + name;
 }
</code></pre>

blocks|key|1207402|text|在我的场景中，我将HttpSession注入到CustomAuthenticationProvider类中，如下所示|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1207403|public+class+CustomAuthenticationProvider+extends++AbstractUserDetailsAuthenticationProvider{

++++@Autowired+
++++private+HttpSession+httpSession;

++++@Override
++++protected+void+additionalAuthenticationChecks(UserDetails+userDetails,+UsernamePasswordAuthenticationToken+usernamePasswordAuthenticationToken)
+++++++++++++throws+AuthenticationException
++++{
++++++++System.out.println("Method+invoked+:+additionalAuthenticationChecks+isAuthenticated+?+:"%2BusernamePasswordAuthenticationToken.isAuthenticated());
++++}

++++@Override
++++protected+UserDetails+retrieveUser(String+username,UsernamePasswordAuthenticationToken+authentication)+throws+AuthenticationException+
++++{
++++++++System.out.println("Method+invoked+:+retrieveUser");
++++++++//so+far+so+good,+i+can+authenticate+user+here,+and+throw+exception+
if+not+authenticated!!
++++++++//THIS+IS+WHERE+I+WANT+TO+ACCESS+SESSION+OBJECT
++++++++httpSession.setAttribute("userObject",+myUserObject);
++++}
}|code-block|syntax|javascript|1207404|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

In my scenario, I've injected the HttpSession into the CustomAuthenticationProvider class
like this

<pre><code>public class CustomAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider{

 @Autowired 
 private HttpSession httpSession;

 @Override
 protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken)
 throws AuthenticationException
 {
 System.out.println("Method invoked : additionalAuthenticationChecks isAuthenticated ? :"+usernamePasswordAuthenticationToken.isAuthenticated());
 }

 @Override
 protected UserDetails retrieveUser(String username,UsernamePasswordAuthenticationToken authentication) throws AuthenticationException 
 {
 System.out.println("Method invoked : retrieveUser");
 //so far so good, i can authenticate user here, and throw exception 
if not authenticated!!
 //THIS IS WHERE I WANT TO ACCESS SESSION OBJECT
 httpSession.setAttribute("userObject", myUserObject);
 }
}
</code></pre>

blocks|key|1422502|text|ServletRequestAttributes+attr+=+(ServletRequestAttributes)+RequestContextHolder.currentRequestAttributes();
attr.getSessionId();|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|1422503|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>ServletRequestAttributes attr = (ServletRequestAttributes) RequestContextHolder.currentRequestAttributes();
attr.getSessionId();
</code></pre>

I am relatively new to <a href="http://en.wikipedia.org/wiki/Spring_Framework" rel="noreferrer">Spring</a> and Spring security.

I was attempting to write a program where I needed to authenticate a user at the server end using Spring security,

I came up with the following:

<pre><code>public class CustomAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider{
 @Override
 protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken)
 throws AuthenticationException
 {
 System.out.println("Method invoked : additionalAuthenticationChecks isAuthenticated ? :"+usernamePasswordAuthenticationToken.isAuthenticated());
 }

 @Override
 protected UserDetails retrieveUser(String username,UsernamePasswordAuthenticationToken authentication) throws AuthenticationException 
 {
 System.out.println("Method invoked : retrieveUser");
 //so far so good, i can authenticate user here, and throw exception if not authenticated!!
 //THIS IS WHERE I WANT TO ACCESS SESSION OBJECT
 }
}
</code></pre>

My usecase is that when a user is authenticated, I need to place an attribute like:

<pre><code>session.setAttribute("userObject", myUserObject);
</code></pre>

myUserObject is an object of some class that I can access throughout my server code across multiple user requests.

How do I get the Session Object in Spring?

身份验证

服务器

我对和Spring安全性比较陌生。我试图写一个程序，我需要在服务器端使用Spring安全来验证用户，我想出了以下几点：public class CustomAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider{    @Over...

问如何在Spring中获取Session对象？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在Spring中获取Session对象？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在Spring中获取Session对象？
EN