Tomcat 唯一 SessionId
有没有办法配置（xml）tomcat（6.x）来生成唯一的SessionId。 （无需扩展 ManagerBase/StandardManager）。
Is there any way to configure(xml) tomcat (6.x) to generate unique SessionId.
(Without extending ManagerBase/StandardManager).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您不应将 Tomcat 生成的会话 ID 作为唯一约束存储在数据库中。这毫无意义。 Tomcat 的会话 ID 仅在所有现有活动会话中是唯一的。 Servlet 规范并不禁止在几个月或几年后的某个时刻将过期会话的 ID 重新用于新会话。使用固定长度的 32 个字符的十六进制字符串作为会话 ID，所有可能的 ID 都不是“无限”的。您无法阻止它在某些时候被不同的客户端重复使用。
我不明白为什么您要将 Tomcat 生成的会话 ID 存储在数据库生命周期中。当它过期时，您应该将其从数据库中删除。或者你应该以不同的方式解决你的问题。由于您没有说明此“解决方案”背后的功能需求，因此我无法给出更合适的答案。不过，这里有一些提示：
反过来做：在数据库中插入或选择必要的数据，获取数据库生成的 ID 并将其存储为
HttpSession的属性。例如登录的用户 ID，或整个User对象。或者，如果需要扩展会话的默认生命周期，例如“记住我”选项，那么您应该自己生成一个 UUID（并测试它是否在数据库中不存在）并在单独的或者
You should not store the Tomcat-generated session ID as an unique constraint in the DB. This makes no sense. Tomcat's session ID is only unique within all existing active sessions. The Servlet spec does not forbid to reuse the ID of an expired session for a new session at some point, months or years later. With a fixed length 32-char hexadecimal string as session ID, all possible IDs are not "unlimited". You can't prevent it from being reused for a different client at some point.
I do not understand why you would ever store a Tomcat-generated session ID in the DB lifetime long. You should remove it from the DB whenever it has expired. Or you should solve your problem differently. As you didn't state anything about the functional requirement behind this "solution", I cannot give a more suited answer. Here are however some hints:
Do it the other way round: insert or select the necessary data in/from DB, get the DB-generated ID and store it as an attribute of the
HttpSession. For example the logged-in user ID, or just the wholeUserobject.Or, if it needs to expand the default lifetime of a session, e.g. "Remember me" option, then you should generate an UUID yourself (and test if it doesn't exist in DB yet) and use it in a separate cookie instead.
我自己正在研究这个问题，我想提一下，可以使用 UUID 使用 128 位（32 个十六进制数字）生成有保证的唯一 ID。它基于UTC时间，只要生成不同UUID的usec时间戳不同，就保证唯一。
另请参阅 RFC4122：https://www.ietf.org/rfc/rfc4122.txt
Java 有一个标准类来生成这些 ID：
http://docs.oracle.com/javase/6 /docs/api/java/util/UUID.htm
I'm working on this issue myself, and I'd like to mention that it is possible to generate a guaranteed unique ID using 128 bits (32 hexadecimal digits) using UUID. It is based on UTC time, and is guaranteed to be unique as long as the usec timestamps at which different UUID are generated are different.
See also RFC4122: https://www.ietf.org/rfc/rfc4122.txt
Java has a standard class for generating these IDs:
http://docs.oracle.com/javase/6/docs/api/java/util/UUID.htm
只需使用复合主键，如 CONSTRAINT PRIMARY KEY ("SID" , datum);
Just use a compound primary key, as CONSTRAINT PRIMARY KEY ("SID" , datum);