使用 Spring Security 记住我，各种问题
我正在使用 Spring Framework 3.0.5 和 Spring Security 3.0.5 开发一个 Web 应用程序，用户可以根据需要使用 Remember-Me-Service 登录和注销。
由于我没有太多经验，我想知道它是否可以正常工作。我使用 PersistentTokenApproach （使用我自己的实现，因为我使用 Hibernate。）我可以看到 cookie 在登录时创建并在注销时删除。 如果我有有效的 Remember-Me-Cookie 并关闭浏览器，则当我再次打开浏览器时，我会再次成功登录。到目前为止，一切都很好。
现在，我只想知道我注意到的那些事情是否按预期工作，或者我是否确实犯了错误。
1) 当用户在没有记住我的情况下登录并且浏览器选项卡关闭（而不是浏览器本身）时，在重新打开新的浏览器选项卡时，他仍然经过身份验证（他使用相同的 JSESSIONID） 。当关闭浏览器并再次重新打开时，他不再经过身份验证。关于网络应用程序的安全性，这是推荐的（“正常”）行为吗？
2) 当使用“记住我”并且用户成功通过身份验证（通过登录或稍后通过 cookie）时，不再对 cookie 进行检查。这意味着，如果同时用户在线，我会从数据库中删除 cookie，用户仍会登录，甚至可以观看受保护的页面。我猜发生这种情况是因为他之前已经过身份验证并且一直使用相同的 SESSIONID。当我关闭浏览器并再次重新打开时，他不再经过身份验证。
3) 当我没有 cookie 并打开主页时，对于我发送的每个请求（页面上的每张图片、每个文件），服务器都会检查 Rememberme-cookie。这是正确的吗？
很抱歉新手问题，但我只是想确保一切都正常工作。 ：-） 提前致谢！
I'm using Spring Framework 3.0.5 and Spring Security 3.0.5 for developing a webapplication where users can log in and log out, using Remember-Me-Service, if they want to.
As I don't have pretty much experience, I wonder if it's working correctly. I use PersistentTokenApproach (with my own implementation, because I use Hibernate.) I can see the cookie is created on login and deleted on logout.
If I have an valid Remember-Me-Cookie and close the Browser, Im successfully logged in again when I open the browser again. So far, so good.
Now, I'd just like to know if those things I noticed are working as they are expected to or if I maybe did make a mistake.
1) When a user logs in without remember-me and the browser-tab is closed (not the browser itself), on reopening a new browser-tab he is still authenticated (he's using the same JSESSIONID). When closing the browser and reopening again, he isn't authenticated anymore. Regarding the security of a webapplication, is this a recommended ("normal") behaviour?
2) When remember-me used and the user is successfully authenticated (by login or later by cookie), there are no more checks on the cookie. that means, if meanwhile the user is online I'd delete the cookie from the database, the user would still be logged in, allowed to watch even the secured pages. I guess this happens because he was authenticated before and keeps using the same SESSIONID. When I close the browser and reopen it again, he isn't authenticated anymore.
3) When I dont own a cookie and open the main page, for every request I send (every picture, every file on the page) the server is checking for the rememberme-cookie. Is that correct?
Sorry for the newbie-questions, but I just want to make sure everything is working as it should. :-) Thanks in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
1）就浏览器中的选项卡而言，我很确定它们都共享相同的浏览器会话。如果您尝试使用 Gmail 或其他基于网络的服务，当您关闭/打开选项卡时，您会看到相同的行为。对于旧版本的 IE（可能是版本 6），单独的实例有自己的会话，除非它们是从现有 IE 实例生成的。
2）这听起来是正确的。在每个请求经过身份验证后都访问数据库并不理想。
3）这是正确的，因为默认情况下，Spring Security 过滤器将过滤 /* - 并尝试查找身份验证信息。您可以将不需要保护的资源添加到安全配置中 - 即
1) As far as tabs within a browser go, I am pretty sure they all share the same browser session. If you try using gmail or other web-based services you'll see the same behaviour when you close / open tabs. With older versions of IE (maybe version 6) separate instances had their own sessions, unless they were spawned from existing IE instances.
2) This sounds correct. Its not really ideal to hit the database on every request after they have been authenticated.
3) That is correct, as by default the spring security filters will be filtering on /* - and trying to look for authentication info. You can add excludes to your security config for resources you dont need to protect- ie