java - RememberMe Spring 安全 : success handler is called multiple times

Question

我正在 Tomcat7 上运行一个 Spring 应用程序。我在 Spring 中使用 security.xml 中的以下 bean 实现了一个记住我的服务:

<remember-me key="SOMEKEY" user-service-ref="defaultUserService"
             authentication-success-handler-ref="rememberMeAuthenticationSuccessHandler" />

我的成功 Controller 看起来像这样:

@Service
public class RememberMeAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
    @Autowired
    private UserService userService;

    private static final Logger logger = LoggerFactory.getLogger(RememberMeAuthenticationSuccessHandler.class);

    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
        User authenticatedUser = (User)authentication.getPrincipal();

        if (authenticatedUser != null) {
            logger.info("Successfully auto-logged in user: " + authenticatedUser.getUsername());
            authenticatedUser.setLastLogin(new Date());
            userService.save(authenticatedUser);
        } else {
            logger.error("Auto-logged in user is empty!");
        }
    }
}

问题是回调运行了多次，所以我将有四次访问数据库。

日志看起来像这样:

2015.07.29 18:13:28 [http-bio-8080-exec-9] INFO  Successfully auto-logged in user: t50@t.it
2015.07.29 18:13:28 [http-bio-8080-exec-1] INFO  Successfully auto-logged in user: t50@t.it
2015.07.29 18:13:28 [http-bio-8080-exec-7] INFO  Successfully auto-logged in user: t50@t.it
2015.07.29 18:13:28 [http-bio-8080-exec-6] INFO  Successfully auto-logged in user: t50@t.it

我认为每个线程都有一个已注册的回调。我认为这与它是一种服务类型这一事实有关，但是我需要它来 Autowiring userRepository

有没有办法优雅地解决这个问题？

非常感谢

Answer 1

这不正常，你能不能记录更多关于请求的信息并再次检查你的客户端代码？

我很确定这是多个客户端调用的结果