Spring Security会话未按预期运行

Question

例如，当我进入登录页面时...sessionCreated-将一个会话添加到计数器：1

然后，当我点击log out按钮时，会话计数减少了1（这很好），但紧接着会话计数增加了1（不是预期的）。

例如，当我按下注销按钮时...sessionDestroyed-从计数器0中扣除一个会话sessionCreated-将一个会话添加到计数器1中

我再次需要帮助来理解请。

这是我的Spring安全设置....

<http pattern="/login.htm" security="none"/>
<http use-expressions="true" auto-config="false" entry-point-ref="loginUrlAuthenticationEntryPoint">    
    <!-- custom filters -->
    <custom-filter position="FORM_LOGIN_FILTER" ref="twoFactorAuthenticationFilter" />
    <custom-filter ref="securityLoggingFilter" after="SECURITY_CONTEXT_FILTER"/>

    <!-- session management --> 
    <session-management 
        invalid-session-url="/sessionExpired.htm" 
        session-authentication-error-url="/alreadyLoggedIn.htm">

        <concurrency-control 
            max-sessions="1" 
            expired-url="/sessionExpiredDuplicateLogin.htm" 
            error-if-maximum-exceeded="false" />
    </session-management>   

    <!-- error handlers -->
    <access-denied-handler error-page="/accessDenied.htm"/>             

    <!-- logout --> 
    <logout logout-success-url="/logout.htm" invalidate-session="true" delete-cookies="JSESSIONID" />   

    <!-- authorize pages -->    
    <intercept-url pattern="/home.htm" access="isAuthenticated()" />
    <intercept-url pattern="/shortsAndOvers.htm" access="isAuthenticated()" />
    <intercept-url pattern="/shortsAndOversDaily.htm" access="isAuthenticated()" />
    <intercept-url pattern="/birtpage.htm" access="isAuthenticated()" />
    <intercept-url pattern="/reports/show.htm" access="isAuthenticated()" />    

</http>

<beans:bean id="loginUrlAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
    <beans:property name="loginFormUrl" value="/login.htm" />
</beans:bean>

<beans:bean id="successHandler" class="com.me.reporting.security.CustomSavedRequestAwareAuthenticationSuccessHandler">
    <beans:property name="defaultTargetUrl" value="/home.htm" />
</beans:bean>

<beans:bean id="failureHandler" class="com.me.reporting.security.CustomSimpleUrlAuthenticationFailureHandler">
    <beans:property name="defaultFailureUrl" value="/loginfailed.htm" />
</beans:bean>  

Answer 1

您可能在不同的上下文中考虑会话。

在您的应用程序周围单击时，看看firebug中的JSESSION cookie，也许它会给您一些答案：）

每次更改JSESSIONID时可能都会调用HttpSessionListener，因此：

null