struts2 session过期适用范围
我的应用程序使用struts2+spring+hibernate，我正在做一些会话拦截器登录授权系统并且它工作正常，现在我尝试实现会话过期部分，我遇到了问题： 首先，会话拦截器检查每个请求以查看用户是否处于会话状态，如果不是，则将其重定向到登录页面，否则将允许执行请求的操作。
因此，如果用户刚刚启动应用程序，则会弹出登录页面
如果会话因会话超时属性而超时 则将其重定向到登录页面
现在，我收到一个显示会话过期消息的请求。 所以我决定使用应用程序范围并设置一些变量，例如 UserLoggedIn 现在回到拦截器，我可以检查用户是否处于会话中，如果其为空，则检查变量 UserLoggedIn 的应用程序范围，因此如果成立，则会话已过期（sessionExpired.jsp），否则为 login.jsp。 问题是，每当我关闭浏览器并重新打开它时，应用程序范围仍然存在，并且 UserLoggedIn 变量随之而来，所以可以说我想启动浏览器和我的应用程序 所以会话拦截器被触发，它在会话上找不到用户，太棒了！但它发现 UserLoggedIn 变量表明这不是一个全新的开始，因此会弹出会话过期消息。我知道这有点令人困惑，我不确定这是否是执行此会话过期操作的正确方法；这是我的第一次尝试。
任何建议、替代方法等，将不胜感激
pd：我知道有更好的方法来保护您的应用程序，例如 spring security 我花了两天时间但失败了，由于时间因素我无法继续尝试
My app uses struts2+spring+hibernate and I was doing some session-interceptor-login-authorisation system and its working alright, now that I try to implement the session expired part I'm running into problems:
first the session interceptor checks for every request to see if a user is on session if not then its redirected to the login page, otherwise its let through the action requested .
so if the user has just began the app the login page pops up
if the session has timeout because of the session-timeout property in web.xml its then redirected to a login page
Now I had a request that a session expired message be displayed.
So I decided to use the app scope and set some variables like UserLoggedIn
and now back to the interceptor I can check for the user to be in session and if its null check the app scope for the variable UserLoggedIn so if founded then session is expired (sessionExpired.jsp) otherwise login.jsp.
the problem is that whenever I close the browser and reopen it, the app scope its still there and UserLoggedIn variable with it so lets say I want to start the browser and my app
so the session interceptor its fired it doesn't find a user on session GReat!! but it found the UserLoggedIn variable which is telling that this is not a brand new start so the session expired message its pop up. I know its kind of confusing Im not sure if this is the right way to do this session expired thing; its my first try.
any advice, alternative methods, etc, will be really appreciated
pd: I know that there are better approaches into securing your app like spring security
I devoted 2 days but failed and because of the time factor Im cant keep trying whit it
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
将会话超时移至拦截器本身可能会更容易，即每次使用拦截器时，它都会为用户设置一个时间值，如果两次调用之间的时间值太大，您将被重定向到会话定时出页。毕竟，是会话告诉您它已过时，因此您应该能够避免应用程序级逻辑。
It might be easier to move the session time out into the interceptor it self, that is every time the interceptor is used it will set a time value for the user if the time value is too great between invocations you will get redirected to the session timed out page. After all it is the session that is telling you that it is stale, so you should be able to avoid application level logic.