如何避免在 Java Web 应用程序中使用服务器端会话进行身份验证？
我希望确保对 Web 应用程序中的资源的访问安全，因此我使用标准机制对用户进行身份验证，并使用服务器端会话来保留经过身份验证的状态。
我想在负载平衡配置中跨多个系统进行部署，但我不想开始跨基础设施同步会话状态。是否有方法（使用 Java EE 中的规范驱动设施或常用的库（如 Spring Security））在没有服务器端会话的情况下保留用户的身份验证状态，例如将所需的状态推送回客户端？如果是这样，我还需要注意其他风险吗？
更新 - 我正在根据 Java EE web 应用程序规范使用声明式安全性，并通过 LDAP 存储库进行身份验证。
I'd like to secure access to resources in my web application, so I authenticate my users using the standard mechanisms and use server-side sessions to preserve the authenticated state.
I'd like to deploy across multiple systems in a load balanced configuration, but I don't want to start synchronising session state across my infrastructure. Are there ways (using either spec-driven facilities in Java EE or commonly available libs like Spring Security) of preserving the authentication state of a user without server-side sessions, for example by pushing the required state back out to the client? If so, are there additional risks I need to be aware of?
Update - I am using declarative security as per Java EE webapp specs and authenticating via an LDAP repository.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我不知道框架解决方案，但以下方法确实有效：
用户成功登录后，您创建一个安全令牌并将其值设置为 cookie。令牌包含所需的所有信息（用户 ID、创建时间等），并使用某种算法进行加密。因此，集群中的所有节点都可以读取令牌、解密令牌并识别用户。然后，您创建一个
ServletFilter拦截所有请求，检查令牌并使用HttpServletRequestWrapper设置相应的用户凭据，例如ServletRequest.getRemoteUser()。解决问题的一种方法。但你一定要小心，自制的安全一定要经过深思熟虑。
I'm not aware of a framework solution, but the following does work:
After the user successfully logged in you create a secured token and set it's value as a cookie. The token contains all information required (user ID, creation time, etc.) and is encrypted using some algorithm. So all nodes in your cluster can read the token, decrypt it and identify the user. Then you create a
ServletFilterintercepting all requests, examining the token and set corresponding user credentials for e.g.ServletRequest.getRemoteUser()by using anHttpServletRequestWrapper.One way to solve the problem. But you must take care, self-made security must be well-thought-out.
您可以在身份验证后将某种令牌存储在 cookie 中，并自行管理会话属性。例如，有一个数据库表，其主键是身份验证令牌并存储用户会话数据...不要忘记实施一项作业来清理不活动的“会话”。
至于你应该注意什么，请记住，cookie 很容易访问、窃取、删除、禁用等。身份验证令牌应该是强大且可验证的东西（哈希用户 ip + 浏览器 + 旋转盐的组合） +您可以检查的一些其他内容）。
将用户身份验证分为两个级别也是明智的。 “有 cookie”和“刚刚验证了 cookie”...假设“有 cookie”是一种可以持续半小时（或更长时间）的状态，允许用户浏览网站。 “刚刚验证”状态适用于重要操作，并且应要求用户再次输入其凭据。这种“刚刚验证状态”的超时不应超过几分钟。
请记住，我假设您的网站并未保存真正敏感的数据。对于这些情况，我会推荐诸如使用外部令牌或安全卡的双向 SSL 身份验证加上旋转令牌设备加上生物识别身份验证之类的东西：D：D：D ...我想您明白我的观点。
干杯，
You can store some kind of token in a cookie after authentication, and manage session attributes yourself. E.g., have a database table whose primary key is the authentication token and stores user session data... Don't forget to implement a job to clean inactive "sessions".
As for what you should be aware of, keep in mind that cookies are something easy to access, steal, delete, disable, etc. The authentication token should be something strong and verifiable (hash a combination of the user ip + browser + rotating salt + some other things you can check for).
It is also wise to divide user authentications in two levels. "Has the cookie" and "just validated the cookie"... Let's say that "has the cookie" is a state that can be there for half an hour (or maybe more) which allows the user to navigate the site. "Just validated" state is for important operations, and should require the user to enter it's credentials again. The timeout for this "just validated state" shouldn't be much longer than a couple of minutes.
Keep in mind that I'm assuming that your site is not holding really sensitive data. For those situations I would recommend something such as two-way SSL authentication with external tokens or security cards plus rotating token devices plus biometrics authentication :D:D:D... I guess you see my point.
Cheers,
您可以使用开放 ID 服务器进行身份验证，从而将身份验证和应用程序逻辑分开。
You can use an open id server to authentication thus separating your authentication and application logic.