spring-security - Spring security OAuth2 - 身份验证后使 session 无效

Question

我们正在使用 spring security OAuth2 保护 REST 服务。应用程序可以调用 /oauth/authorize , /oauth/token或 /rest-api端点。 token 和 rest-api 端点是无状态的，不需要 session 。

我们可以在用户通过身份验证后使 session 无效吗？如果是这样，最好的方法是什么。我们希望用户在调用 /oauth/authorize 时始终登录制作。目前，调用/oauth/authorize只要 session 存在，就会跳过身份验证。

Answer 1

理解这个问题有点老了，我希望以下内容对那些寻找问题正确答案的人有所帮助

OP 询问的不是 token 失效，而是如何在用户身份验证成功通过并且有效的 access_token 或 authentication_code(用于随后获取 access_token)返回客户端后立即使 Spring OAuth2 服务器上的 httpSession 失效。

这个用例仍然没有开箱即用的解决方案。但是可以找到 spring-security-oauth 最活跃的贡献者 Dave Syer 的工作解决方法 here on GitHub

只需从那里复制代码:

@Service
@Aspect
public class SessionInvalidationOauth2GrantAspect {

    private static final String FORWARD_OAUTH_CONFIRM_ACCESS = "forward:/oauth/confirm_access";
    private static final Logger logger = Logger.getLogger(SessionInvalidationOauth2GrantAspect.class);

    @AfterReturning(value = "within(org.springframework.security.oauth2.provider.endpoint..*) && @annotation(org.springframework.web.bind.annotation.RequestMapping)", returning = "result")
    public void authorizationAdvice(JoinPoint joinpoint, ModelAndView result) throws Throwable {

        // If we're not going to the confirm_access page, it means approval has been skipped due to existing access
        // token or something else and they'll be being sent back to app. Time to end session.
        if (!FORWARD_OAUTH_CONFIRM_ACCESS.equals(result.getViewName())) {
            invalidateSession();
        }
    }

    @AfterReturning(value = "within(org.springframework.security.oauth2.provider.endpoint..*) && @annotation(org.springframework.web.bind.annotation.RequestMapping)", returning = "result")
    public void authorizationAdvice(JoinPoint joinpoint, View result) throws Throwable {
        // Anything returning a view and not a ModelView is going to be redirecting outside of the app (I think). 
        // This happens after the authorize approve / deny page with the POST to /oauth/authorize. This is the time
        // to kill the session since they'll be being sent back to the requesting app.
        invalidateSession();
    }

    @AfterThrowing(value = "within(org.springframework.security.oauth2.provider.endpoint..*) &&  @annotation(org.springframework.web.bind.annotation.RequestMapping)", throwing = "error")
    public void authorizationErrorAdvice(JoinPoint joinpoint) throws Throwable {
        invalidateSession();
    }

    private void invalidateSession() {
        HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes())
                .getRequest();
        HttpSession session = request.getSession(false);
        if (session != null) {
            logger.warn(String.format("As part of OAuth application grant processing, invalidating session for request %s", request.getRequestURI()));

            session.invalidate();
            SecurityContextHolder.clearContext();
        }
    }

}

添加 pom.xml

<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-aspects</artifactId>
</dependency>

另一种解决方案可能是将 session 超时设置为一些非常小的值。实现这一点的最简单方法是将以下内容放入 application.yml 配置:

server:
  session:
    timeout: 1

但这不是理想的解决方案，因为提供者的最小值可能是 1(为无限 session 保留零)并且它以分钟而不是秒为单位