Spring Security：跨域传递会话
我正在开发一个 Web 应用程序，该应用程序必须使用不同的域通过 http 和 https 进行访问。现在我面临以下问题：当用户访问http域时，一些信息存储在会话中。当用户转换到 https 时，用户所属会话的信息将丢失（因为会话 ID 存储在与 http 域关联的 cookie 中）。
在用户切换域后，如何将正确的会话重新附加到用户？
是否可以在发送 requires-channel="https" 引起的重定向之前执行一些 java 代码？
编辑：我认为 Spring Security 中可能有一些特定的东西可以使用，但到目前为止我无法在文档中找到任何内容。
编辑2：刚刚发现我可能需要做的是将 ChannelProcessingFilter 替换为自定义实现。但我不知道我必须做什么才能使 Spring Security 接受我的新类而不是默认的 ChannelProcessingFilter。注意：我使用的是Spring 3.0。
I'm working on a web application that has to use different domains for access over http and https. Now I'm facing the following problem: While the user is accessing the http-domain, some information is stored inside the session. When the user makes the transition to https the information which session the user belongs to is lost (because the session id is stored in the cookie that is associated with the http-domain).
How can I reattach the correct session to the user after he has switched domains?
Is it possible to execute some java-code right before the redirect that is caused by requires-channel="https" is sent?
Edit: I was thinking there might be something specific in Spring Security that could be used, but so far I wasn't able to find anything in the documentation.
Edit 2: Just found out that what I probably need to do is to replace the ChannelProcessingFilter with a custom implementation. But I don't know what I have to do to make spring security to accept my new class instead of the default ChannelProcessingFilter. Note: I'm using Spring 3.0.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我们通过提供一个自定义 ChannelProcessor 解决了这个问题，该自定义 ChannelProcessor 在默认 ChannelProcessor 之前执行，并发送包含 jsessionid 作为 URL 参数的重定向。然后，默认的 ChannelProcessor 使用此 URL 并将另一个重定向发送到 http 域。
要将 URL 参数更改回会话 ID 的“;”格式，我们在 apache 中提供了一些附加指令：
然后由 tomcat 评估 URL，并在不同的域上继续相同的会话。
We solved the problem by supplying a custom ChannelProcessor that gets executed right before the default ChannelProcessor and sends a redirect that includes the jsessionid as an URL parameter. Then the default ChannelProcessor uses this URL and sends another redirect to the http-domain.
To change the URL-parameter back to the ";"-format for session ids we have some additional directives in the apache:
The URL is then evaluated by the tomcat and continues the same session on a different domain.
查看这篇文章，了解有关此问题的信息/解决方案 - 会话在 PHP 中从 HTTP 切换到 HTTPS 时丢失
Check out this post for information/resolution on this - Session lost when switching from HTTP to HTTPS in PHP