java - Spring Security session 超时太短

Question

我不知道怎么办，但 session 超时非常短。据我所知，Spring Security session 超时取决于默认服务器的 session 配置。我发现 GlassFish 超时为 1800 秒(10 分钟)。但我认为 session 每 5 分钟删除一次。怎么会发生这样的事？这是我的 Spring Security 配置:

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-3.2.xsd">    



    <!-- enable use-expressions -->
    <http auto-config="true" use-expressions="true">

        <intercept-url pattern="/adminRole/**" access="hasRole('ROLE_ADMIN')" />

        <intercept-url pattern="/userRole/**" access="hasRole('ROLE_USER')" />

        <!-- access denied page -->
        <access-denied-handler error-page="/403" />

        <form-login 
            login-page="/" 
            default-target-url="/resolveRoles" 
            authentication-failure-url="/?error" 
            username-parameter="username"
            password-parameter="password" />
            <remember-me key="key" token-validity-seconds="2419200" />
        <logout logout-success-url="/?logout"  />
        <!-- enable csrf protection -->

    </http>



    <!-- Select users and user_roles from database -->
    <authentication-manager>
      <authentication-provider>
      <password-encoder hash="sha"/>      
        <jdbc-user-service data-source-ref="dataSource"
          users-by-username-query=
            "select username,password, enabled from smsc.users where username=?"
          authorities-by-username-query=
            "select username, role from smsc.user_roles where username =?  " />
      </authentication-provider>
    </authentication-manager>

</beans:beans>

Answer 1

Spring Security 中只有 session 超时，但没有额外的超时(除了记住我 token 的超时，但这是另一回事)。

您可以在web.xml中配置 session 超时:

<web-app>
   <session-config>
      <!-- in minutes -->
      <session-timeout>60</session-timeout>
   </session-config>
</web-app>