java - 在 session 超时监听器中区分超时破坏的 session 和手动破坏的 session

Question

这个问题已经有答案了:

recognizing session timeout [duplicate] (3 个回答)

已关闭 8 年前。

我想实现一个在 session 过期时将被调用的监听器，我发现我可以创建一个实现接口(interface) HttpSessionListener 的监听器，并重写方法 sessionDestroyed

public class SessionListener implements HttpSessionListener {

   @Override
   public void sessionCreated(HttpSessionEvent sessionEvent) {
      // TODO Auto-generated method stub
   }

   @Override
   public void sessionDestroyed(HttpSessionEvent sessionEvent) {
         // TODO Auto-generated method stub         
   }
}

但问题是每次 session 被销毁时都会调用这个方法，例如登录和注销，那么我如何知道 session 过期后 session 被销毁，或者除了HttpSessionListener之外是否有其他解决方案.

PS:我在应用程序中使用 Spring 框架。

Answer 1

也许你可以尝试这样猜测:

possible_timeout = (CurrentTime - LastAccessedTime) >= MaxInactiveInterval。

// HttpServlet

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

    System.out.println("Inside doGet(HttpServletRequest,HttpServletResponse)");

    HttpSession session = request.getSession(true);
    System.out.println("Session Id : " +session.getId() );
    System.out.println( "Is New Session : " + session.isNew() );

    int timeout = 10;
    session.setMaxInactiveInterval(timeout);

    System.out.println( "Max Inactive Interval : " + session.getMaxInactiveInterval() );

    System.out.println("Exiting doGet(HttpServletRequest,HttpServletResponse)");
    System.out.println();

}


// SessionEventListener

public void sessionCreated(HttpSessionEvent httpSessionEvent) {
    System.out.println("In sessionCreated(HttpSessionEvent) ");
    HttpSession httpSession = httpSessionEvent.getSession();
    System.out.println("Session Id :"+httpSession.getId() );
    System.out.println("Exiting sessionCreated(HttpSessionEvent) ");
    System.out.println();
}


public void sessionDestroyed(HttpSessionEvent httpSessionEvent) {

    System.out.println("In sessionDestroyed(HttpSessionEvent) ");

    HttpSession httpSession = httpSessionEvent.getSession();
    long createdTime = httpSession.getCreationTime();
    long lastAccessedTime = httpSession.getLastAccessedTime();
    int maxInactiveTime = httpSession.getMaxInactiveInterval();
    long currentTime = System.currentTimeMillis();

    System.out.println("Session Id :"+httpSession.getId() );
    System.out.println("Created Time : " + createdTime);
    System.out.println("Last Accessed Time : " + lastAccessedTime);
    System.out.println("Current Time : " + currentTime);
    boolean possibleSessionTimeout = (currentTime-lastAccessedTime) >= (maxInactiveTime*1000);

    System.out.println("Possbile Timeout : " + possibleSessionTimeout);
    System.out.println("Exiting sessionDestroyed(HttpSessionEvent)");
    System.out.println();
}

输出如下:

Inside doGet(HttpServletRequest,HttpServletResponse)
In sessionCreated(HttpSessionEvent) 
Session Id :39F84968757E85ED89E7565639322F1F
Exiting sessionCreated(HttpSessionEvent) 

Session Id : 39F84968757E85ED89E7565639322F1F
Is New Session : true
Max Inactive Interval : 10
Exiting doGet(HttpServletRequest,HttpServletResponse)

In sessionDestroyed(HttpSessionEvent) 
Session Id :39F84968757E85ED89E7565639322F1F
Created Time : 1383729761582
Last Accessed Time : 1383729761587
Current Time : 1383729815839
Possbile Timeout : true
Exiting sessionDestroyed(HttpSessionEvent)

我观察到不一定会立即检测到超时。似乎有一个线程定期检查 session 超时。此外，还会对每个请求进行检查。