java - tomcat中的Spring警告输出 "Failed to create a session"

Question

我收到以下消息，但我不明白它们的意思。一切似乎都运行正常，但我只是想安全起见。是否可以针对这些警告采取措施:

2011-01-25/23:30:06.856/EST [http-80-exec-1] WARN 无法创建 session ，因为已提交响应。无法存储 SecurityContext。

2011-01-25/23:30:09.597/EST [http-80-exec-3] WARN 身份验证事件 InteractiveAuthenticationSuccessEvent:email@domain.com；详细信息:org.springframework.security.web.authentication.WebAuthenticationDetails@957e: RemoteIpAddress: 170.9.26.16; SessionId: null

我正在运行 spring 3 和 tomcat 6 以及 spring security 3

更新

我根据此信息(来自 here)重新配置了以下 bean:

create-session

Controls the eagerness with which an HTTP session is created. If not set, defaults to "ifRequired". Other options are "always" and "never". The setting of this attribute affect the allowSessionCreation and forceEagerSessionCreation properties of HttpSessionContextIntegrationFilter. allowSessionCreation will always be true unless this attribute is set to "never". forceEagerSessionCreation is "false" unless it is set to "always". So the default configuration allows session creation but does not force it. The exception is if concurrent session control is enabled, when forceEagerSessionCreation will be set to true, regardless of what the setting is here. Using "never" would then cause an exception during the initialization of HttpSessionContextIntegrationFilter.

<bean id="httpSessionContextIntegrationFilter" class="org.springframework.security.web.context.HttpSessionContextIntegrationFilter">
    <property name="allowSessionCreation" value="false"/>
</bean>

Answer 1

将以下内容添加到您的配置中:http session-creation='never'>有关 Spring 论坛的更多信息:http://forum.springsource.org/showthread.php?t=82196