spring-session + redis 保存会话 session

基于spring-boot + spring-session + redis 实现 session 共享

依赖

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-redis</artifactId>
    <version>${spring-boot-starter-data-redis.version}</version>
</dependency>
<dependency>
    <groupId>org.springframework.session</groupId>
    <artifactId>spring-session-data-redis</artifactId>
    <version>${spring-session-data-redis.version}</version>
</dependency>

spring-boot 1.x

import com.alibaba.fastjson.support.spring.GenericFastJsonRedisSerializer;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.data.redis.serializer.RedisSerializer;
import org.springframework.session.config.annotation.web.http.SpringHttpSessionConfiguration;
import org.springframework.session.data.redis.config.ConfigureRedisAction;
import org.springframework.session.data.redis.config.annotation.web.http.EnableRedisHttpSession;
import org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration;
import org.springframework.session.web.http.CookieHttpSessionStrategy;
import org.springframework.session.web.http.CookieSerializer;
import org.springframework.session.web.http.DefaultCookieSerializer;
import org.springframework.session.web.http.HttpSessionStrategy;

/**
 * 使用 redis 存储 HttpSession
 * <pre>
 *     spring-boot 两种方式启用 spring-session + redis
 *     1、使用 @EnableRedisHttpSession 注解，需要在注解配置 session 失效时间，使用注解 spring.session.timeout 会无效
 *     2、在application.properties 配置 spring.session.store-type: redis
 *     优先级：@EnableRedisHttpSession > application.properties
 * </pre>
 *
 * @author Created by YL on 2018/11/7
 */
@EnableRedisHttpSession(maxInactiveIntervalInSeconds = 86400)
public class RedisHttpSessionConfig {
    /**
     * disable sessions expire event notifications
     */
    @Bean
    public ConfigureRedisAction configureRedisAction() {
        return ConfigureRedisAction.NO_OP;
    }

    /**
     * spring-session 使用 fastjson 序列化
     * <p>bean name 要配置成 <strong>springSessionDefaultRedisSerializer</strong>，否则不生效，参考：
     * {@link RedisHttpSessionConfiguration#setDefaultRedisSerializer(org.springframework.data.redis.serializer.RedisSerializer)}</p>
     */
    @Bean
    @Qualifier("springSessionDefaultRedisSerializer")
    public RedisSerializer<Object> springSessionDefaultRedisSerializer() {
        return new GenericFastJsonRedisSerializer();
    }

    /**
     * cookie serializer
     * <p>
     * {@link SpringHttpSessionConfiguration#setCookieSerializer(org.springframework.session.web.http.CookieSerializer)}
     */
    @Bean
    @Qualifier("cookieSerializer")
    public CookieSerializer cookieSerializer() {
        DefaultCookieSerializer serializer = new DefaultCookieSerializer();
        serializer.setCookieName("x-auth-token");
        // serializer.setDomainName("localhost");
        // serializer.setDomainNamePattern("(\\w+)");//("^.+?\\.(\\w+\\.[a-z]+)$");
        serializer.setCookiePath("/");
        serializer.setUseHttpOnlyCookie(true);
        // 由于spring-boot 1.x和2.x这个默认值不一样，所以统一设置成 false
        serializer.setUseBase64Encoding(false);
        // 防止 http、https 混用的情况
        serializer.setUseSecureCookie(false);
        return serializer;
    }

    /**
     * HttpSessionStrategy
     * <p>
     * {@link SpringHttpSessionConfiguration#setHttpSessionStrategy(org.springframework.session.web.http.HttpSessionStrategy)}
     */
    @Bean
    @Qualifier("httpSessionStrategy")
    public HttpSessionStrategy httpSessionStrategy() {
        CookieHttpSessionStrategy strategy = new CookieHttpSessionStrategy();
        strategy.setCookieSerializer(cookieSerializer());
        return strategy;
    }

    // /**
    //  * HttpSessionStrategy
    //  * <p>
    //  * {@link SpringHttpSessionConfiguration#setHttpSessionStrategy(org.springframework.session.web.http
    // .HttpSessionStrategy)}
    //  */
    // @Bean
    // @Qualifier("httpSessionStrategy")
    // public HttpSessionStrategy httpSessionStrategy() {
    //     HeaderHttpSessionStrategy strategy = new HeaderHttpSessionStrategy();
    //     strategy.setHeaderName(UTConst.COOKIE_NAME);
    //     return strategy;
    // }
}

spring-boot 2.x

import com.alibaba.fastjson.support.spring.GenericFastJsonRedisSerializer;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.data.redis.serializer.RedisSerializer;
import org.springframework.session.config.annotation.web.http.SpringHttpSessionConfiguration;
import org.springframework.session.data.redis.config.ConfigureRedisAction;
import org.springframework.session.data.redis.config.annotation.web.http.EnableRedisHttpSession;
import org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration;
import org.springframework.session.web.http.CookieHttpSessionIdResolver;
import org.springframework.session.web.http.CookieSerializer;
import org.springframework.session.web.http.DefaultCookieSerializer;
import org.springframework.session.web.http.HttpSessionIdResolver;

/**
* 使用 redis 存储 HttpSession
* <pre>
*     spring-boot 两种方式启用 spring-session + redis
*     1、使用 @EnableRedisHttpSession 注解，需要在注解配置 session 失效时间，使用注解 spring.session.timeout 会无效
*     2、在application.properties 配置 spring.session.store-type: redis
*     优先级：@EnableRedisHttpSession > application.properties
* </pre>
*
* @author Created by YL on 2018/11/7
*/
@EnableRedisHttpSession(maxInactiveIntervalInSeconds = 86400)
public class RedisHttpSessionConfig {
   /**
    * disable sessions expire event notifications
    */
   @Bean
   public ConfigureRedisAction configureRedisAction() {
       return ConfigureRedisAction.NO_OP;
   }

   /**
    * spring-session 使用 fastjson 序列化
    * <p>bean name 要配置成 <strong>springSessionDefaultRedisSerializer</strong>，否则不生效，参考：
    * {@link RedisHttpSessionConfiguration#setDefaultRedisSerializer(RedisSerializer)}</p>
    */
   @Bean
   @Qualifier("springSessionDefaultRedisSerializer")
   public RedisSerializer<Object> springSessionDefaultRedisSerializer() {
       return new GenericFastJsonRedisSerializer();
   }

   /**
    * cookie serializer
    * <p>
    * {@link SpringHttpSessionConfiguration#setCookieSerializer(CookieSerializer)}
    */
   @Bean
   @Qualifier("cookieSerializer")
   public CookieSerializer cookieSerializer() {
       DefaultCookieSerializer serializer = new DefaultCookieSerializer();
       serializer.setCookieName("x-auth-token");
       // serializer.setDomainName("localhost");
       // serializer.setDomainNamePattern("(\\w+)");//("^.+?\\.(\\w+\\.[a-z]+)$");
       serializer.setCookiePath("/");
       serializer.setUseHttpOnlyCookie(true);
       // 由于spring-boot 1.x和2.x这个默认值不一样，所以统一设置成 false
       serializer.setUseBase64Encoding(false);
       // 防止 http、https 混用的情况
       serializer.setUseSecureCookie(false);
       return serializer;
   }

   /**
    * HttpSessionIdResolver
    * <p>
    * {@link SpringHttpSessionConfiguration#setHttpSessionIdResolver(HttpSessionIdResolver)}
    */
   @Bean
   @Qualifier("httpSessionIdResolver")
   public HttpSessionIdResolver httpSessionIdResolver() {
       CookieHttpSessionIdResolver resolver = new CookieHttpSessionIdResolver();
       resolver.setCookieSerializer(cookieSerializer());
       return resolver;
   }

   // /**
   //  * HttpSessionIdResolver
   //  * <p>
   //  * {@link SpringHttpSessionConfiguration#setHttpSessionIdResolver(HttpSessionIdResolver)}
   //  */
   // @Bean
   // @Qualifier("httpSessionIdResolver")
   // public HttpSessionIdResolver httpSessionIdResolver() {
   //     return new HeaderHttpSessionIdResolver("x-gdwxkf-token");
   // }
}

问题

应用容器 session 过期时间

server:
  servlet:
    session:
      timeout: 1d

• server.servlet.session.timeout参数对于SpringBoot内嵌的Tomcat生效。

• 如果项目部署在外部Tomcat中，该参数对外部Tomcat不生效。

  外部Tomcat部署可以这样配置session过期时间

  • 第一种：在web.xml中

    <session-config>
        <session-timeout>30</session-timeout>
    </session-config>

  • 第二种：在Tomcat的conf/server.xml中

    <Context path="/app" docBase="/app" defaultSessionTimeOut="86400" .../>

  • 第三种：在Java程序中

    session.setMaxInactiveInterval(86400);