SpringSecurity实战教程（十三）会话管理机制 - 并发控制与会话固定攻击防护

1
@Configuration
2
@EnableWebSecurity
3
public class SecurityConfig {
4

5
    // 1. 注册 Session 事件监听器，使 Spring Security 能及时感知会话生命周期事件
6
    @Bean
7
    public HttpSessionEventPublisher httpSessionEventPublisher() {
8
        return new HttpSessionEventPublisher();
9
    }
10

11
    @Bean
12
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
13
        http
14
            .sessionManagement(session -> session
15
                .maximumSessions(1)                     // 同一用户仅允许 1 个会话
16
                .maxSessionsPreventsLogin(true)         // true：超出拒绝后续登录；false：踢出最早会话
17
                .expiredUrl("/login?expired")           // 会话过期后重定向地址
18
            );
19
        return http.build();
20
    }
21
}

1
@Configuration
2
@EnableWebSecurity
3
public class SessionSecurityConfig {
4

5
    @Bean
6
    public HttpSessionEventPublisher httpSessionEventPublisher() {
7
        return new HttpSessionEventPublisher();
8
    }
9

10
    @Bean
11
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
12
        http
13
            .authorizeHttpRequests(auth -> auth
14
                .anyRequest().authenticated()
15
            )
16
            .formLogin(withDefaults())
17
            .sessionManagement(session -> session
18
                .sessionFixation(sf -> sf.migrateSession())
19
                .maximumSessions(1)
20
                .maxSessionsPreventsLogin(true)
21
                .expiredUrl("/login?expired")
22
            );
23
        return http.build();
24
    }
25

26
    @Bean
27
    public UserDetailsService userDetailsService() {
28
        UserDetails user = User.withDefaultPasswordEncoder()
29
                .username("user")
30
                .password("password")
31
                .roles("USER")
32
                .build();
33
        return new InMemoryUserDetailsManager(user);
34
    }
35
}

1
import com.toher.springsecurity.demo.session.management.DemoSessionApplication;
2
import org.junit.jupiter.api.Test;
3
import org.springframework.beans.factory.annotation.Autowired;
4
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
5
import org.springframework.boot.test.context.SpringBootTest;
6
import org.springframework.mock.web.MockHttpSession;
7
import org.springframework.test.web.servlet.MockMvc;
8
import org.springframework.test.web.servlet.MvcResult;
9

10
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestBuilders.formLogin;
11
import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
12
import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.unauthenticated;
13
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
14

15
@SpringBootTest(classes = DemoSessionApplication.class)
16
@AutoConfigureMockMvc
17
public class SessionConcurrencyTest {
18

19
    @Autowired
20
    private MockMvc mockMvc;
21

22
    @Test
23
    void testConcurrentLogin() throws Exception {
24
        // 第一次登录
25
        MvcResult mvcResult = mockMvc.perform(formLogin())
26
                .andExpect(authenticated())
27
                .andReturn();
28
        MockHttpSession firstLoginSession = (MockHttpSession) mvcResult.getRequest().getSession();
29

30
        mockMvc.perform(get("/").session(firstLoginSession))
31
                .andExpect(authenticated());
32

33
        // 第二次登录将被拒绝
34
        mockMvc.perform(formLogin()).andExpect(authenticated());
35

36
        // 验证第一次会话已失效
37
        mockMvc.perform(get("/").session(firstLoginSession))
38
                .andExpect(unauthenticated());
39
    }
40
}