第十四章： Spring Boot 整合spring-session,使用redis共享

前沿

本文重点讲述：spring boot工程中使用spring-session机制进行安全认证，并且通过redis存储session，满足集群部署、分布式系统的session共享。

基于SPringBoot 2.3.2.RELEASE

背景

在传统单机web应用中，一般使用tomcat/jetty等web容器时，用户的session都是由容器管理。浏览器使用cookie中记录sessionId，容器根据sessionId判断用户是否存在会话session。这里的限制是，session存储在web容器中，被单台服务器容器管理。

但是网站主键演变，分布式应用和集群是趋势（提高性能）。此时用户的请求可能被负载分发至不同的服务器，此时传统的web容器管理用户会话session的方式即行不通。除非集群或者分布式web应用能够共享session，尽管tomcat等支持这样做。但是这样存在以下两点问题：

xml 复制代码

1、需要侵入web容器，提高问题的复杂
2、web容器之间共享session，集群机器之间势必要交互耦合

基于这些，必须提供新的可靠的集群分布式/集群session的解决方案，突破traditional-session单机限制（即web容器session方式，下面简称traditional-session），spring-session应用而生。

traditional-session和spring-session的区别

springboot-session 集成redis示例

添加依赖：在pom.xml文件中添加Spring Session Redis的依赖。

xml 复制代码

<dependency>  
    <groupId>org.springframework.session</groupId>  
    <artifactId>spring-session-data-redis</artifactId>  
</dependency>
<dependency>
            <groupId>io.lettuce</groupId>
            <artifactId>lettuce-core</artifactId>
</dependency>
        <!-- 对象池，使用redis时必须引入 -->
<dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-pool2</artifactId>
</dependency>

配置Redis：在application.yaml文件中添加Redis的配置信息，包括Redis的地址、端口号、密码等。

yaml 复制代码

server:
  port: 8080
  servlet:
    context-path: /
    # session超时时间 默认30分钟
    session:
      timeout: 30m
spring:
  session:
    store-type: redis
    redis:
      # 会话刷新模式
      flush-mode: immediate
      # 用于存储会话的键的命名空间
      namespace: "spring:session"
  redis:
    host: 192.168.92.105
    port: 6379
    password: foobared
    # 连接超时时间（记得添加单位，Duration）
    timeout: 10000ms
    # Redis默认情况下有16个分片，这里配置具体使用的分片
    # database: 0
    lettuce:
      pool:
        # 连接池最大连接数（使用负值表示没有限制） 默认 8
        max-active: 8
        # 连接池最大阻塞等待时间（使用负值表示没有限制） 默认 -1
        max-wait: -1ms
        # 连接池中的最大空闲连接 默认 8
        max-idle: 8
        # 连接池中的最小空闲连接 默认 0
        min-idle: 0

注解开启session功能：并使用@EnableRedisHttpSession注解开启session功能。同时，可以设置session的超时时间。

java 复制代码

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.session.data.redis.config.annotation.web.http.EnableRedisHttpSession;

@SpringBootApplication
@EnableRedisHttpSession
public class SpringbootDay09Application {

    public static void main(String[] args) {
        SpringApplication.run(SpringbootDay09Application.class, args);
    }

}

创建Controller：在需要使用session的Controller中，注入HttpSession对象，并使用它来存储session数据。

java 复制代码

@RestController  
public class SessionController {  
    @Autowired  
    private HttpSession httpSession;  
    @GetMapping("/set")  
    public String set(String name, String value) {  
        httpSession.setAttribute(name, value);  
        return "set " + name + "=" + value;  
    }  
    @GetMapping("/get")  
    public String get(String name) {  
        return (String) httpSession.getAttribute(name);  
    }  
}

测试：分别调用各应用接口，查看sessionId是否一致。同时，可以查看Redis缓存信息，缓存中的sessionId与接口返回信息一致。

spring-session特点与工作原理

特点

spring-session在无需绑定web容器的情况下提供对集群session的支持。并提供对以下情况的透明集成：

HttpSession：容许替换web容器的HttpSession
WebSocket：使用WebSocket通信时，提供Session的活跃
WebSession：容许以应用中立的方式替换webflux的webSession

工作原理

spring-session分为以下核心模块：

SessionRepositoryFilter：Servlet规范中Filter的实现，用来切换HttpSession至Spring Session，包装

HttpServletRequest和HttpServletResponse
HttpServerletRequestWrapper、HttpServletResponseWrapper、HttpSessionWrapper包装器：包装原有的HttpServletRequest、HttpServletResponse和Spring Session，实现切换Session和透明继承HttpSession的关键之所在
Session：Spring Session模块
SessionRepository：管理Spring Session的模块
HttpSessionStrategy：映射HttpRequest和HttpResponse到Session的策略

SessionRepositoryFilter

SessionRepositoryFilter继承OncePerRequestFilter实现Filter

java 复制代码

protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    // 设置SessionRepository至Request的属性中
        request.setAttribute(SESSION_REPOSITORY_ATTR, this.sessionRepository);
    // 包装原始HttpServletRequest至SessionRepositoryRequestWrapper
        SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper wrappedRequest = new SessionRepositoryFilter.SessionRepositoryRequestWrapper(request, response);
    // 包装原始HttpServletResponse响应至SessionRepositoryResponseWrapper
        SessionRepositoryFilter.SessionRepositoryResponseWrapper wrappedResponse = new SessionRepositoryFilter.SessionRepositoryResponseWrapper(wrappedRequest, response);

        try {
            filterChain.doFilter(wrappedRequest, wrappedResponse);
        } finally {
              // 提交session
            wrappedRequest.commitSession();
        }

    }

2、 SessionRepository

java 复制代码

public interface SessionRepository<S extends Session> {
    S createSession();

    void save(S var1);

    S findById(String var1);

    void deleteById(String var1);
}

创建、保存、获取、删除Session的接口行为。根据Session的不同，分为很多种Session操作仓库。

当创建一个RedisSession，然后存储在Redis中时，RedisSession的存储细节如下：

spring:session:sessions:33fdd1b6-b496-4b33-9f7d-df96679d32fe

spring:session:sessions:expires:33fdd1b6-b496-4b33-9f7d-df96679d32fe

spring:session:expirations:1439245080000

Redis会为每个RedisSession存储三个k-v。

properties 复制代码

第一个:k-v用来存储Session的详细信息，包括Session的过期时间间隔、最近的访问时间、attributes等等。这个k的过期时间为Session的最大过期时间 + 5分钟。如果默认的最大过期时间为30分钟，则这个k的过期时间为35分钟
第二个:k-v用来表示Session在Redis中的过期，这个k-v不存储任何有用数据，只是表示Session过期而设置。这个k在Redis中的过期时间即为Session的过期时间间隔
第三个:k-v存储这个Session的id，是一个Set类型的Redis数据结构。这个k中的最后的1439245080000值是一个时间戳，根据这个Session过期时刻滚动至下一分钟而计算得出。

3、 Session

spring-session和tomcat中的Session的实现模式上有很大不同，tomcat中直接对HttpSession接口进行实现，而spring-session中则抽象出单独的Session层接口，让后再使用适配器模式将Session适配层Servlet规范中的HttpSession。spring-sesion中关于session的实现和适配整个UML类图如下：

MapSession的代码源码片段

java 复制代码

public final class MapSession implements Session, Serializable {
    public static final int DEFAULT_MAX_INACTIVE_INTERVAL_SECONDS = 1800;
    private String id;
    private final String originalId;
    private Map<String, Object> sessionAttrs;
    private Instant creationTime;
    private Instant lastAccessedTime;
    private Duration maxInactiveInterval;
    private static final long serialVersionUID = 7160779239673823561L;

    public MapSession() {
        this(generateId());
    }

    public MapSession(String id) {
        this.sessionAttrs = new HashMap();
        this.creationTime = Instant.now();
        this.lastAccessedTime = this.creationTime;
        this.maxInactiveInterval = Duration.ofSeconds(1800L);
        this.id = id;
        this.originalId = id;
    }

    public MapSession(Session session) {
        this.sessionAttrs = new HashMap();
        this.creationTime = Instant.now();
        this.lastAccessedTime = this.creationTime;
        this.maxInactiveInterval = Duration.ofSeconds(1800L);
        if (session == null) {
            throw new IllegalArgumentException("session cannot be null");
        } else {
            this.id = session.getId();
            this.originalId = this.id;
            this.sessionAttrs = new HashMap(session.getAttributeNames().size());
            Iterator var2 = session.getAttributeNames().iterator();

            while(var2.hasNext()) {
                String attrName = (String)var2.next();
                Object attrValue = session.getAttribute(attrName);
                if (attrValue != null) {
                    this.sessionAttrs.put(attrName, attrValue);
                }
            }

            this.lastAccessedTime = session.getLastAccessedTime();
            this.creationTime = session.getCreationTime();
            this.maxInactiveInterval = session.getMaxInactiveInterval();
        }
    }

    public void setLastAccessedTime(Instant lastAccessedTime) {
        this.lastAccessedTime = lastAccessedTime;
    }

    public Instant getCreationTime() {
        return this.creationTime;
    }

    public String getId() {
        return this.id;
    }

    public String getOriginalId() {
        return this.originalId;
    }

    public String changeSessionId() {
        String changedId = generateId();
        this.setId(changedId);
        return changedId;
    }

    public Instant getLastAccessedTime() {
        return this.lastAccessedTime;
    }

    public void setMaxInactiveInterval(Duration interval) {
        this.maxInactiveInterval = interval;
    }

    public Duration getMaxInactiveInterval() {
        return this.maxInactiveInterval;
    }

    public boolean isExpired() {
        return this.isExpired(Instant.now());
    }

    boolean isExpired(Instant now) {
        if (this.maxInactiveInterval.isNegative()) {
            return false;
        } else {
            return now.minus(this.maxInactiveInterval).compareTo(this.lastAccessedTime) >= 0;
        }
    }

    public <T> T getAttribute(String attributeName) {
        return this.sessionAttrs.get(attributeName);
    }

    public Set<String> getAttributeNames() {
        return new HashSet(this.sessionAttrs.keySet());
    }

    public void setAttribute(String attributeName, Object attributeValue) {
        if (attributeValue == null) {
            this.removeAttribute(attributeName);
        } else {
            this.sessionAttrs.put(attributeName, attributeValue);
        }

    }

    public void removeAttribute(String attributeName) {
        this.sessionAttrs.remove(attributeName);
    }

    public void setCreationTime(Instant creationTime) {
        this.creationTime = creationTime;
    }

    public void setId(String id) {
        this.id = id;
    }

    public boolean equals(Object obj) {
        return obj instanceof Session && this.id.equals(((Session)obj).getId());
    }

    public int hashCode() {
        return this.id.hashCode();
    }

    private static String generateId() {
        return UUID.randomUUID().toString();
    }
}

RedisSession的代码源码片段

java 复制代码

    final class RedisSession implements Session {
        private final MapSession cached;
        private final Map<String, Object> delta = new HashMap();
        private boolean isNew;
        private String originalSessionId;

        RedisSession(MapSession cached, boolean isNew) {
            this.cached = cached;
            this.isNew = isNew;
            this.originalSessionId = cached.getId();
            if (this.isNew) {
                this.delta.put("creationTime", cached.getCreationTime().toEpochMilli());
                this.delta.put("maxInactiveInterval", (int)cached.getMaxInactiveInterval().getSeconds());
                this.delta.put("lastAccessedTime", cached.getLastAccessedTime().toEpochMilli());
            }

            if (this.isNew || RedisSessionRepository.this.saveMode == SaveMode.ALWAYS) {
                this.getAttributeNames().forEach((attributeName) -> {
                    this.delta.put(RedisSessionRepository.getAttributeKey(attributeName), cached.getAttribute(attributeName));
                });
            }

        }

        public String getId() {
            return this.cached.getId();
        }

        public String changeSessionId() {
            return this.cached.changeSessionId();
        }

        public <T> T getAttribute(String attributeName) {
            T attributeValue = this.cached.getAttribute(attributeName);
            if (attributeValue != null && RedisSessionRepository.this.saveMode.equals(SaveMode.ON_GET_ATTRIBUTE)) {
                this.delta.put(RedisSessionRepository.getAttributeKey(attributeName), attributeValue);
            }

            return attributeValue;
        }

        public Set<String> getAttributeNames() {
            return this.cached.getAttributeNames();
        }

        public void setAttribute(String attributeName, Object attributeValue) {
            this.cached.setAttribute(attributeName, attributeValue);
            this.delta.put(RedisSessionRepository.getAttributeKey(attributeName), attributeValue);
            this.flushIfRequired();
        }

        public void removeAttribute(String attributeName) {
            this.setAttribute(attributeName, (Object)null);
        }

        public Instant getCreationTime() {
            return this.cached.getCreationTime();
        }

        public void setLastAccessedTime(Instant lastAccessedTime) {
            this.cached.setLastAccessedTime(lastAccessedTime);
            this.delta.put("lastAccessedTime", this.getLastAccessedTime().toEpochMilli());
            this.flushIfRequired();
        }

        public Instant getLastAccessedTime() {
            return this.cached.getLastAccessedTime();
        }

        public void setMaxInactiveInterval(Duration interval) {
            this.cached.setMaxInactiveInterval(interval);
            this.delta.put("maxInactiveInterval", (int)this.getMaxInactiveInterval().getSeconds());
            this.flushIfRequired();
        }

        public Duration getMaxInactiveInterval() {
            return this.cached.getMaxInactiveInterval();
        }

        public boolean isExpired() {
            return this.cached.isExpired();
        }

        private void flushIfRequired() {
            if (RedisSessionRepository.this.flushMode == FlushMode.IMMEDIATE) {
                this.save();
            }

        }

        private boolean hasChangedSessionId() {
            return !this.getId().equals(this.originalSessionId);
        }

        private void save() {
            this.saveChangeSessionId();
            this.saveDelta();
            if (this.isNew) {
                this.isNew = false;
            }

        }

        private void saveChangeSessionId() {
            if (this.hasChangedSessionId()) {
                if (!this.isNew) {
                    String originalSessionIdKey = RedisSessionRepository.this.getSessionKey(this.originalSessionId);
                    String sessionIdKey = RedisSessionRepository.this.getSessionKey(this.getId());
                    RedisSessionRepository.this.sessionRedisOperations.rename(originalSessionIdKey, sessionIdKey);
                }

                this.originalSessionId = this.getId();
            }

        }

        private void saveDelta() {
            if (!this.delta.isEmpty()) {
                String key = RedisSessionRepository.this.getSessionKey(this.getId());
                RedisSessionRepository.this.sessionRedisOperations.opsForHash().putAll(key, new HashMap(this.delta));
                RedisSessionRepository.this.sessionRedisOperations.expireAt(key, Date.from(Instant.ofEpochMilli(this.getLastAccessedTime().toEpochMilli()).plusSeconds(this.getMaxInactiveInterval().getSeconds())));
                this.delta.clear();
            }
        }
    }
}

在RedisSession中有两个非常重要的成员属性：

properties 复制代码

cached：实际上是一个MapSession实例，用于做本地缓存，每次在getAttribute时无需从Redis中获取，主要为了improve性能
delta：用于跟踪变化数据，做持久化

4、SessionRepositoryRequestWrapper

对于开发人员获取HttpSession的api

java 复制代码

HttpServletRequest request = ...;
HttpSession session = request.getSession(true);

在spring session中request的实际类型SessionRepositoryRequestWrapper。调用SessionRepositoryRequestWrapper的getSession方法会触发创建spring session，而非web容器的HttpSession。

SessionRepositoryRequestWrapper用来包装原始的HttpServletRequest实现HttpSession切换至Spring Session。是透明Spring Session透明集成HttpSession的关键。

SessionRepositoryRequestWrapper继承HttpServletRequestWrapper，在构造方法中将原有的HttpServletRequest通过调用super完成对HttpServletRequestWrapper中持有的HttpServletRequest初始化赋值，然后重写和session相关的方法。这样就保证SessionRepositoryRequestWrapper的其他方法调用都是使用原有的HttpServletRequest的数据，只有session相关的是重写的逻辑。

java 复制代码

private final class SessionRepositoryRequestWrapper extends HttpServletRequestWrapper {
        private final HttpServletResponse response;
        private S requestedSession;
        private boolean requestedSessionCached;
        private String requestedSessionId;
        private Boolean requestedSessionIdValid;
        private boolean requestedSessionInvalidated;

        private SessionRepositoryRequestWrapper(HttpServletRequest request, HttpServletResponse response) {
            super(request);
            this.response = response;
        }

        private void commitSession() {
            SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper.HttpSessionWrapper wrappedSession = this.getCurrentSession();
            if (wrappedSession == null) {
                if (this.isInvalidateClientSession()) {
                    SessionRepositoryFilter.this.httpSessionIdResolver.expireSession(this, this.response);
                }
            } else {
                S session = wrappedSession.getSession();
                this.clearRequestedSessionCache();
                SessionRepositoryFilter.this.sessionRepository.save(session);
                String sessionId = session.getId();
                if (!this.isRequestedSessionIdValid() || !sessionId.equals(this.getRequestedSessionId())) {
                    SessionRepositoryFilter.this.httpSessionIdResolver.setSessionId(this, this.response, sessionId);
                }
            }

        }

        private SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper.HttpSessionWrapper getCurrentSession() {
            return (SessionRepositoryFilter.SessionRepositoryRequestWrapper.HttpSessionWrapper)this.getAttribute(SessionRepositoryFilter.CURRENT_SESSION_ATTR);
        }

        private void setCurrentSession(SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper.HttpSessionWrapper currentSession) {
            if (currentSession == null) {
                this.removeAttribute(SessionRepositoryFilter.CURRENT_SESSION_ATTR);
            } else {
                this.setAttribute(SessionRepositoryFilter.CURRENT_SESSION_ATTR, currentSession);
            }

        }

        public String changeSessionId() {
            HttpSession session = this.getSession(false);
            if (session == null) {
                throw new IllegalStateException("Cannot change session ID. There is no session associated with this request.");
            } else {
                return this.getCurrentSession().getSession().changeSessionId();
            }
        }

        public boolean isRequestedSessionIdValid() {
            if (this.requestedSessionIdValid == null) {
                S requestedSession = this.getRequestedSession();
                if (requestedSession != null) {
                    requestedSession.setLastAccessedTime(Instant.now());
                }

                return this.isRequestedSessionIdValid(requestedSession);
            } else {
                return this.requestedSessionIdValid;
            }
        }

        private boolean isRequestedSessionIdValid(S session) {
            if (this.requestedSessionIdValid == null) {
                this.requestedSessionIdValid = session != null;
            }

            return this.requestedSessionIdValid;
        }

        private boolean isInvalidateClientSession() {
            return this.getCurrentSession() == null && this.requestedSessionInvalidated;
        }

        public SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper.HttpSessionWrapper getSession(boolean create) {
            SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper.HttpSessionWrapper currentSession = this.getCurrentSession();
            if (currentSession != null) {
                return currentSession;
            } else {
                S requestedSession = this.getRequestedSession();
                if (requestedSession != null) {
                    if (this.getAttribute(SessionRepositoryFilter.INVALID_SESSION_ID_ATTR) == null) {
                        requestedSession.setLastAccessedTime(Instant.now());
                        this.requestedSessionIdValid = true;
                        currentSession = new SessionRepositoryFilter.SessionRepositoryRequestWrapper.HttpSessionWrapper(requestedSession, this.getServletContext());
                        currentSession.markNotNew();
                        this.setCurrentSession(currentSession);
                        return currentSession;
                    }
                } else {
                    if (SessionRepositoryFilter.SESSION_LOGGER.isDebugEnabled()) {
                        SessionRepositoryFilter.SESSION_LOGGER.debug("No session found by id: Caching result for getSession(false) for this HttpServletRequest.");
                    }

                    this.setAttribute(SessionRepositoryFilter.INVALID_SESSION_ID_ATTR, "true");
                }

                if (!create) {
                    return null;
                } else {
                    if (SessionRepositoryFilter.SESSION_LOGGER.isDebugEnabled()) {
                        SessionRepositoryFilter.SESSION_LOGGER.debug("A new session was created. To help you troubleshoot where the session was created we provided a StackTrace (this is not an error). You can prevent this from appearing by disabling DEBUG logging for " + SessionRepositoryFilter.SESSION_LOGGER_NAME, new RuntimeException("For debugging purposes only (not an error)"));
                    }

                    S session = SessionRepositoryFilter.this.sessionRepository.createSession();
                    session.setLastAccessedTime(Instant.now());
                    currentSession = new SessionRepositoryFilter.SessionRepositoryRequestWrapper.HttpSessionWrapper(session, this.getServletContext());
                    this.setCurrentSession(currentSession);
                    return currentSession;
                }
            }
        }

        public SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper.HttpSessionWrapper getSession() {
            return this.getSession(true);
        }

        public String getRequestedSessionId() {
            if (this.requestedSessionId == null) {
                this.getRequestedSession();
            }

            return this.requestedSessionId;
        }

        public RequestDispatcher getRequestDispatcher(String path) {
            RequestDispatcher requestDispatcher = super.getRequestDispatcher(path);
            return new SessionRepositoryFilter.SessionRepositoryRequestWrapper.SessionCommittingRequestDispatcher(requestDispatcher);
        }

        private S getRequestedSession() {
            if (!this.requestedSessionCached) {
                List<String> sessionIds = SessionRepositoryFilter.this.httpSessionIdResolver.resolveSessionIds(this);
                Iterator var2 = sessionIds.iterator();

                while(var2.hasNext()) {
                    String sessionId = (String)var2.next();
                    if (this.requestedSessionId == null) {
                        this.requestedSessionId = sessionId;
                    }

                    S session = SessionRepositoryFilter.this.sessionRepository.findById(sessionId);
                    if (session != null) {
                        this.requestedSession = session;
                        this.requestedSessionId = sessionId;
                        break;
                    }
                }

                this.requestedSessionCached = true;
            }

            return this.requestedSession;
        }

        private void clearRequestedSessionCache() {
            this.requestedSessionCached = false;
            this.requestedSession = null;
            this.requestedSessionId = null;
        }

5、 SessionRepositoryResponseWrapper

java 复制代码

private final class SessionRepositoryResponseWrapper extends OnCommittedResponseWrapper {
        private final SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper request;

        SessionRepositoryResponseWrapper(SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper request, HttpServletResponse response) {
            super(response);
            if (request == null) {
                throw new IllegalArgumentException("request cannot be null");
            } else {
                this.request = request;
            }
        }

        protected void onResponseCommitted() {
            this.request.commitSession();
        }
    }

5、 SessionRepositoryResponseWrapper 

```java
private final class SessionRepositoryResponseWrapper extends OnCommittedResponseWrapper {
        private final SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper request;

        SessionRepositoryResponseWrapper(SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper request, HttpServletResponse response) {
            super(response);
            if (request == null) {
                throw new IllegalArgumentException("request cannot be null");
            } else {
                this.request = request;
            }
        }

        protected void onResponseCommitted() {
            this.request.commitSession();
        }
    }

从注释上可以看出包装响应时为了：确保如果响应被提交session能够被保存。

第十四章 ： Spring Boot 整合spring-session,使用redis共享

第十四章 ： Spring Boot 整合spring-session,使用redis共享

前沿

背景

traditional-session和spring-session的区别

springboot-session 集成redis示例

spring-session特点与工作原理

特点

工作原理

spring-session分为以下核心模块：

第十四章： Spring Boot 整合spring-session,使用redis共享

第十四章： Spring Boot 整合spring-session,使用redis共享