如何在java spring boot/spring security（HttpSecurity）中自动注销会话过期

Question

通过自动注销，我的意思是当会话到期时，浏览器将自己重定向到注销url，而用户不必单击任何将他重定向到注销url的链接。

导入org.springframework.beans.factory.annotation.autowired；导入org.springframework.boot.autocigure.security.securityproperties；导入org.springframework.context.annotation.bean；导入org.springframework.context.annotation.configuration；导入org.springframework.core.annotation.order；导入org.springframework.security.access.vote.rolevoter；导入org.springframework.security.config.annotation.authentication.builders.authenticationmanagerbuilder；导入org.springframework.security.config.annotation.method.configuration.enableGlobalMethodSecurity；导入org.springframework.security.config.annotation.web.builders.HttpSecurity；导入org.springframework.security.config.annotation.web.builders.websecurity；导入org.springframework.security.config.annotation.web.configuration.enablewebsecurity；导入org.springframework.security.config.annotation.web.configuration.websecurityconfigeradapter；导入org.springframework.security.config.http.SessionCreationPolicy；

/**  * Created by plato on 5/5/2016.  */ 

@Configuration@EnableWebSecurity@EnableGlobalMethodSecurity（prePostEnabled=true）@Order(SecurityProperties.Access_Override_Order)公共类SecurityConfig扩展WebSecurityConfigurerAdapter{

    @Autowired
    DatabaseAuthenticationProvider authenticationProvider;

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/js/**", "/css/**", "/img/**", "/templates/**", "/thymeleaf/**");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.formLogin()
                .loginPage("/login")
                .failureUrl("/login?failed=true")
                .defaultSuccessUrl("/login-success")
                .and().logout()
                .logoutSuccessUrl("/")
                .and().authorizeRequests()
                .antMatchers("/admin**", "/api/admin/**").hasAuthority("ADMIN")
                .antMatchers("/**")
                .permitAll()
                .anyRequest().authenticated()
                .and().csrf().disable()
                .sessionManagement()
                .maximumSessions(1)
                .expiredUrl("/login?expired-session")
                .and()
                .invalidSessionUrl("/?invalid-session");
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authenticationProvider).eraseCredentials(true);
    }
 }

Answer 1

客户必须轮询。那里的服务器无法“推”重定向。

客户机可以每隔X段时间轮询一次，其中X只比会话超时长一点。如果轮询的频率高于此频率，则会刷新会话，因此不会超时。客户端可以在每次用户交互时重置计时器。