Spring SecurityOAuth2-验证后使会话无效

Question

我们正在使用Spring安全OAuth2保护REST服务。应用程序可以调用/oauth/授权、/oauth/令牌或/rest-api终结点。令牌和rest api终结点是无状态的，不需要会话。

我们可以在用户经过身份验证后使会话无效吗？如果是，最好的方法是什么。我们希望用户在调用/oauth/authorize时始终登录。当前，每当会话存在时，对/oauth/authorize的调用都会跳过身份验证。

Answer 1

第一：在您的配置中，为oauth声明带有令牌存储的bean

@Bean
@Primary
public TokenStore tokenStore() {
    return new InMemoryTokenStore();
}

对于控制器方法，我们制作了以下类

@Controller
 public class TokenController {

    @RequestMapping(value = "/oauth/token/revoke", method = RequestMethod.POST)
    public @ResponseBody void create(@RequestParam("token") String value) {
        this.revokeToken(value);
    }

    @Autowired
    TokenStore tokenStore;

    public boolean revokeToken(String tokenValue) {
        OAuth2AccessToken accessToken = tokenStore.readAccessToken(tokenValue);
        if (accessToken == null) {
            return false;
        }
        if (accessToken.getRefreshToken() != null) {
            tokenStore.removeRefreshToken(accessToken.getRefreshToken());
        }
        tokenStore.removeAccessToken(accessToken);
        return true;
    }
}

如果您不想使用这种方法，您可以获取当前用户的令牌自动连线主体：

    OAuth2Authentication authorization = (OAuth2Authentication) principal;
    OAuth2AuthenticationDetails details = (OAuth2AuthenticationDetails) authorization.getDetails();
    String token = details.getTokenValue();

或者甚至自动连接OAuth2身份验证：

    OAuth2AuthenticationDetails details = (OAuth2AuthenticationDetails) authentication.getDetails();
    String token = details.getTokenValue();

Answer 2

据我所知，您正在尝试在执行某些操作后以编程方式注销。也许您应该研究一下SecurityContextLogoutHandler，看看它是如何工作的。这里有一个注销的方法。我认为把它作为一个建议会解决你的问题。

public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
      Assert.notNull(request, "HttpServletRequest required");
      if (invalidateHttpSession) {
          HttpSession session = request.getSession(false);
          if (session != null) {
              session.invalidate();
          }
      }

      SecurityContextHolder.clearContext();
  }

Answer 3

理解到这个问题有点老了，我希望下面的内容能对那些为这个问题寻找正确答案的人有所帮助

OP询问的不是令牌失效，而是如何在用户身份验证成功通过并将有效的access_token或authorization_code（用于后续获取access_token）返回给客户端后立即在Spring OAuth2服务器上使http会话失效。

这个用例仍然没有现成的解决方案。但是SpringSecurityOAuth最活跃的贡献者DaveSyer的工作方法可以在GitHub上找到

只需从那里复制代码：

@Service
@Aspect
public class SessionInvalidationOauth2GrantAspect {

    private static final String FORWARD_OAUTH_CONFIRM_ACCESS = "forward:/oauth/confirm_access";
    private static final Logger logger = Logger.getLogger(SessionInvalidationOauth2GrantAspect.class);

    @AfterReturning(value = "within(org.springframework.security.oauth2.provider.endpoint..*) && @annotation(org.springframework.web.bind.annotation.RequestMapping)", returning = "result")
    public void authorizationAdvice(JoinPoint joinpoint, ModelAndView result) throws Throwable {

        // If we're not going to the confirm_access page, it means approval has been skipped due to existing access
        // token or something else and they'll be being sent back to app. Time to end session.
        if (!FORWARD_OAUTH_CONFIRM_ACCESS.equals(result.getViewName())) {
            invalidateSession();
        }
    }

    @AfterReturning(value = "within(org.springframework.security.oauth2.provider.endpoint..*) && @annotation(org.springframework.web.bind.annotation.RequestMapping)", returning = "result")
    public void authorizationAdvice(JoinPoint joinpoint, View result) throws Throwable {
        // Anything returning a view and not a ModelView is going to be redirecting outside of the app (I think). 
        // This happens after the authorize approve / deny page with the POST to /oauth/authorize. This is the time
        // to kill the session since they'll be being sent back to the requesting app.
        invalidateSession();
    }

    @AfterThrowing(value = "within(org.springframework.security.oauth2.provider.endpoint..*) &&  @annotation(org.springframework.web.bind.annotation.RequestMapping)", throwing = "error")
    public void authorizationErrorAdvice(JoinPoint joinpoint) throws Throwable {
        invalidateSession();
    }

    private void invalidateSession() {
        HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes())
                .getRequest();
        HttpSession session = request.getSession(false);
        if (session != null) {
            logger.warn(String.format("As part of OAuth application grant processing, invalidating session for request %s", request.getRequestURI()));

            session.invalidate();
            SecurityContextHolder.clearContext();
        }
    }

}

添加pom。xml

<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-aspects</artifactId>
</dependency>

另一个解决方案是将会话超时设置为某个非常小的值。实现这一点的最简单方法是应用以下内容。yml配置：

server:
  session:
    timeout: 1

但这并不是理想的解决方案，因为提供程序可以使用的最小值是1（为无限个会话保留零），并且是以分钟而不是秒为单位