java - 用户登录和 session 劫持后的 Spring Security cookie

Question

据我了解，当用户登录 Spring Security 时，会使 session 无效并创建一个新 session 。
因此，如果我来自带有明确 sessionID cookie 的 http，Spring Security 应该设置一个新的 sessionID“安全”cookie，该 cookie 将仅在后续 https 请求时由浏览器发回。
我缺少的是当“登录”用户从 https 切换到 http 时，必须有一个 sessionID cookie 作为非安全 cookie 存储在某处以跟踪 session 。
我不明白 Spring 是如何管理它的。
用户登录后，如果他浏览到 http，那么清晰的 sessionID cookie 是否与安全的 SessionID 相同，并且它对世界可见吗？有人可以读取它并劫持 session 。
我不明白 Spring Security 流程，谁能解释一下它是如何工作的？
谢谢

Answer 1

出于您描述的原因，最好不要混合使用 HTTP 和 HTTPS session 。事实上，它似乎通过 HTTPS 登录然后回落到 HTTP 不会工作(因为浏览器不会发送安全 session cookie)。

[...] sessions created under HTTPS, for which the session cookie is marked as “secure”, cannot subsequently be used under HTTP. The browser will not send the cookie back to the server and any session state will be lost (including the security context information). Starting a session in HTTP first should work as the session cookie won't be marked as secure (you will also have to disable Spring Security's Session Fixation Protection support to prevent it from creating a new secure session on login (you can always create a new session yourself at a later stage). Note that switching between HTTP and HTTPS is not a good idea in general, as any application which uses HTTP at all is vulnerable to man-in-the-middle attacks. To be truly secure, the user should begin accessing your site in HTTPS and continue using it until they log out. Even clicking on an HTTPS link from a page accessed over HTTP is potentially risky.

来自 http://static.springsource.org/spring-security/site/faq.html