java - Spring Security session 在实例化时抛出错误

Question

我在正在创建的 Web 应用程序中使用 Spring security，但在如何使用 session 方面遇到了问题。

我登录后一切正常，但当我尝试使用 session 时它总是会抛出错误。

当调用此代码中的第六行时:

@POST
@Path("PostUserData/{userId}")
@Produces(MediaType.APPLICATION_JSON + ";charset=UTF-8")
public final Response postUserData(@PathParam("userId") String userId, String input){
    Response response;
    ServletRequestAttributes attr = (ServletRequestAttributes)RequestContextHolder.currentRequestAttributes();
    HttpSession session= attr.getRequest().getSession(true); // true == allow create

    response = Response.created(null).build();
    return response;
}

出现这个错误:

java.lang.IllegalStateException: No thread-bound request found: Are you referring to request attributes outside of an actual web request, or processing a request outside of the originally receiving thread? If you are actually operating within a web request and still receive this message, your code is probably running outside of DispatcherServlet/DispatcherPortlet: In this case, use RequestContextListener or RequestContextFilter to expose the current request.
    at org.springframework.web.context.request.RequestContextHolder.currentRequestAttributes(RequestContextHolder.java:131)

我正在按照 http://www.baeldung.com/spring-security-session 的指示进行操作.

我的安全应用程序上下文 xml 文件中重要的是:

<http pattern="/**" use-expressions="true" create-session="always">
    <intercept-url pattern="/**" access="permitAll" />
    <form-login
            username-parameter="username"
            password-parameter="password" login-processing-url="/login"
            login-page='/login.jsp'
            default-target-url='/View/Login/SelectUser.html'
            always-use-default-target='true'
            authentication-failure-url="/login.jsp"/>
    <logout logout-url="/logout/" logout-success-url="/" />
    <session-management invalid-session-url="/">
        <concurrency-control expired-url="/" max-sessions="2" />
    </session-management>
</http>

我已经在我的 web.xml 中添加了

<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
         version="3.1">
    <welcome-file-list>
        <welcome-file>/</welcome-file>
    </welcome-file-list>

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            /WEB-INF/security-app-context.xml
        </param-value>
    </context-param>

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <welcome-file-list>
        <welcome-file>login.jsp</welcome-file>
        <welcome-file>login.html</welcome-file>
        <welcome-file>login.htm</welcome-file>
    </welcome-file-list>

    <listener>
        <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
    </listener>

</web-app>

有人知道可能出了什么问题吗？我是否需要实例化 session 或其他东西？

Answer 1

为什么不简单地将 HttpSession 添加为方法的参数？

像这样:

@POST
@Path("PostUserData/{userId}")
@Produces(MediaType.APPLICATION_JSON + ";charset=UTF-8")
public final Response postUserData(@PathParam("userId") String userId, 
        String input, HttpSession session){

    // Your method here
    return Response.created(null).build();
}