java - session 超时不起作用 vaadin

Question

我正在开发一个 vaadin 网络应用程序，并在我的 web.xml 中添加了以下代码片段。

<session-config>
    <session-timeout>30</session-timeout>
</session-config>

现在我注意到 30 分钟后我的用户也可以使用该应用程序，我不希望这样。我在 vaadin 的书上读到了一些关于这个问题的东西，但我并没有理解一些东西。

来自 vaadin 书:

Session Timeout After User Inactivity

In normal servlet operation, the session timeout defines the allowed time of inactivity after which the server should clean up the session. The inactivity is measured from the last server request. Different servlet containers use varying defaults for timeouts, such as 30 minutes for Apache Tomcat. You can set the timeout under with:

In a web.xml:

<session-config>
   <session-timeout>30</session-timeout> 
  </session-config>

The session timeout should be longer than the heartbeat interval or otherwise sessions are closed before the heartbeat can keep them alive. As the session expiration leaves the UIs in a state where they assume that the session still exists, this would cause an Out Of Sync error notification in the browser.

However, having a shorter heartbeat interval than the session timeout, which is the normal case, prevents the sessions from expiring. If the closeIdleSessions parameter for the servlet is enabled (disabled by default), Vaadin closes the UIs and the session after the time specified in the session-timeout parameter expires after the last non-heartbeat request.

In a web.xml:

<servlet>
...
<init-param>
  <param-name>closeIdleSessions</param-name>
  <param-value>true</param-value>
</init-param>

现在我认为问题是我的应用程序服务器让 UI 处于假定 session 仍然存在的状态，但我无法理解心跳是什么？以及 closeSessionId 的具体作用是什么？

Answer 1

心跳表示客户端还存在。比如当用户关闭浏览器后，客户端就不能发送心跳了，服务器检测到这一点并清理服务器端的用户界面。默认情况下，这会使 session 永远保持 Activity 状态。因此，如果这不是您必须在 web.xml 中设置的预期行为:

<init-param>
    <description>Enable Session Timeout</description>
    <param-name>closeIdleSessions</param-name>
    <param-value>true</param-value>
</init-param>