java - 如何找到给定 HTTP session 所属的用户

Question

介绍:

我有一个 JIRA 实例，许多外部工具通过 REST 使用它。其中一些工具不会重用它们创建的 HTTP session ，这会导致为每个请求创建一个新 session 。

问题:

创建过多的 session 会导致 Not Acceptable 资源消耗。所以我正在寻找一种方法:

• 通过拒绝他们的登录尝试来限制行为不端的客户不要创建太多 session - 从而迫使他们的所有者修复他们的客户

• 使旧 session 无效从而释放服务器上的资源

但为了做到这一点我需要知道给定 session 属于哪个用户，所以当用户 X 达到可以说是 5 个 session 的限制时 - 我可以使他的旧 session 无效或拒绝他的请求。

问题:

如何从 HttpSessionListener 将 session 映射到用户？有没有更好的方法来实现我的目标？也许是 JIRA 特定的东西？

Answer 1

我找到了一个非常聪明的方法来实现我的目标:

So to work around this problem in a general sense we put together the atlassian-bot-killer plugin.

This works on sessions by inverting the idea. A request may have gotten a session but does it deserve to keep it?

What this plugin does is watch every request via a servlet Filter and checks if it has seen the session before. If not it must be the first request for that session.

It then stores the original session timeout in the session itself and sets the session inactivity timeout to be 1 minute. If the session makes a second request then it gets bumped back to the original timeout of say 5 hours. It gets upgraded if you will since we know that the user agent is preserving sessions.

A user behind a web browser often makes a second request milliseconds after the first. JavaScript, CSS files all count as requests. So a human user does not notice this at all.

A web bot however does not preserve JSESSIONID cookies and hence is always presenting as a first request. These will then get a 1 minute time out and hence die quickly. The memory load on the server is greatly reduced.

REST requests from tools such as curl typically do no preserve sessions either and hence they can fall into the same class of request, even if they are done in terms of a user say via BASIC AUTH.

The atlassian-bot-killer follows the same strategy on requests with a known user however to be conservative it sets the inactivity time out to be 10 minutes instead of 1.

来源:http://blogs.atlassian.com/2012/03/getting-rid-of-unwanted-http-sessions/

PS:其实有一个现成的插件:https://marketplace.atlassian.com/plugins/com.atlassian.labs.atlassian-bot-killer/versions