Spring Security 梳理 - session

Spring Security默认的行为是每个登录成功的用户会新建一个Session。这也就是下面的配置的效果：

<http create-session="ifRequired">...</http>

这貌似没有问题，但其实对大规模的网站是致命的。用户越多，新建的session越多，最后的结果是JVM内存耗尽，你的web服务器彻底挂了。有session的另外一个严重的问题是scalability能力，用户压力上来了不能马上新建一台Jetty/Tomcat服务器，因为要考虑Session同步的问题。 先来看看Session过多导致的Jetty JVM 内存耗尽：

Spring Security 3.1开始支持stateless authentication（具体查看 What‘s new in Spring Security 3.1?），配置方法是：

<http create-session="stateless">
    <!-- ... -->
</http>

主要是在RESTful API，无状态的web调用的stateless authentication。

这个配置的意思是：Spring Security对登录成功的用户不会创建Session了，你的application也不会允许新建session，而且Spring Security会跳过所有的 filter chain：HttpSessionSecurityContextRepository, SessionManagementFilter, RequestCacheFilter.

也就是说每个请求都是无状态的独立的，需要被再次认证re-authentication。开销显然是增大了，因为每次请求都必须在服务器端重新认证并建立用户角色和权限的上下文。

Stateless的RESTful authentication认证

刚才说了，配置为stateless的使用场景，例如RESTful api，其每个请求都是无状态的独立的，需要被再次认证re-authentication。操作层面，具体做法是：在每一个REST的call的头header（例如：@HeaderParam annotation. 例子: @HeaderParam.）都带user token 和 application ID，然后在服务器端对每一请求进行re-authentication. （注意：把token放在uri中是糟糕的做法，首先是安全的原因，其次是cache的原因，尽量放在head中）可以写一个拦截器来实现：

@Provider
@ServerInterceptor
public class RestSecurityInterceptor implements PreProcessInterceptor {

    @Override
    public ServerResponse preProcess(HttpRequest request, ResourceMethod method)
           throws UnauthorizedException {

        String token = request.getHttpHeaders().getRequestHeader("token").get(0);

        // user not logged-in?
        if (checkLoggedIn(token)) {
            ServerResponse response = new ServerResponse();
            response.setStatus(HttpResponseCodes.SC_UNAUTHORIZED);
            MultivaluedMap<String, Object> headers = new Headers<Object>();
            headers.add("Content-Type", "text/plain");
            response.setMetadata(headers);
            response.setEntity("Error 401 Unauthorized: "
                 + request.getPreprocessedPath());
            return response;
        }
        return null;
    }
}

Spring Security配置文件：

<security:http realm="Protected API" use-expressions="true" auto-config="false" create-session="stateless" entry-point-ref="CustomAuthenticationEntryPoint">
    <security:custom-filter ref="authenticationTokenProcessingFilter" position="FORM_LOGIN_FILTER" />
    <security:intercept-url pattern="/authenticate" access="permitAll"/>
    <security:intercept-url pattern="/**" access="isAuthenticated()" />
</security:http>

<bean id="CustomAuthenticationEntryPoint"
    class="com.demo.api.support.spring.CustomAuthenticationEntryPoint" />

<bean class="com.demo.api.support.spring.AuthenticationTokenProcessingFilter"
    id="authenticationTokenProcessingFilter">
    <constructor-arg ref="authenticationManager" />
</bean>

CustomAuthenticationEntryPoint：

public class CustomAuthenticationEntryPoint implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response,
            AuthenticationException authException) throws IOException, ServletException {
        response.sendError( HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized: Authentication token was either missing or invalid." );
    }
}

AuthenticationTokenProcessingFilter：

@Autowired UserService userService;
    @Autowired TokenUtils tokenUtils;
    AuthenticationManager authManager;

    public AuthenticationTokenProcessingFilter(AuthenticationManager authManager) {
        this.authManager = authManager;
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {
        @SuppressWarnings("unchecked")
        Map<String, String[]> parms = request.getParameterMap();

        if(parms.containsKey("token")) {
            String token = parms.get("token")[0]; // grab the first "token" parameter

            // validate the token
            if (tokenUtils.validate(token)) {
                // determine the user based on the (already validated) token
                UserDetails userDetails = tokenUtils.getUserFromToken(token);
                // build an Authentication object with the user's info
                UsernamePasswordAuthenticationToken authentication =
                        new UsernamePasswordAuthenticationToken(userDetails.getUsername(), userDetails.getPassword());
                authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails((HttpServletRequest) request));
                // set the authentication into the SecurityContext
                SecurityContextHolder.getContext().setAuthentication(authManager.authenticate(authentication));
            }
        }
        // continue thru the filter chain
        chain.doFilter(request, response);
    }
}

TokenUtils： 

public interface TokenUtils {
    String getToken(UserDetails userDetails);
    String getToken(UserDetails userDetails, Long expiration);
    boolean validate(String token);
    UserDetails getUserFromToken(String token);
}

Spring Security其它方面

其他的比如concurrent Session，意思是同一个用户允许同时在线（不同地点）的数量。还有Session劫持的防止, auto-remember等，具体参考这个网页。

参考：https://www.cnblogs.com/Mainz/p/3230077.html