java - 我可以使用 Spring Security 管理多个浏览器选项卡吗？

Question

我想知道，如果使用 Spring Security，我是否可以验证用户 session ，只允许打开一个浏览器选项卡。可能吗？

我还想知道我是否可以做到这一点，当用户关闭选项卡并在他的 session 结束前再次打开它时，从直接应用程序 SessionFilter 中再次打开它，而无需转到登录屏幕。

我正在使用 JSF 1.2、RichFaces 3.3.3、Hibernate 和其他...

详情:我知道spring security，我正在研究它。

现在感谢并原谅我糟糕的英语。

再见!

Answer 1

没有。 Spring Security 无法判断请求是来自原始选项卡还是来自新选项卡 - 该信息严格来自客户端。来自 http://static.springsource.org/spring-security/site/faq.html :

2.1.

I'm using Spring Security's concurrent session control to prevent users from logging in more than once at a time. When I open another browser window after logging in, it doesn't stop me from logging in again. Why can I log in more than once?

Browsers generally maintain a single session per browser instance. You cannot have two separate sessions at once. So if you log in again in another window or tab you are just reauthenticating in the same session. The server doesn't know anything about tabs, windows or browser instances. All it sees are HTTP requests and it ties those to a particular session according to the value of the the JSESSIONID cookie that they contain. When a user authenticates during a session, Spring Security's concurrent session control checks the number of other authenticated sessions that they have. If they are already authenticated with the same session, then re-authenticating will have no effect.