在不使用cookie API访问会话的情况下获取sessionId

Question

我需要获得当前会话ID而不会访问会话(以使其有机会到期).

我使用了来自Servlet代码的Cookie,以保持会话未被触及,然后在超时时间后使会话过期.

我使用以下代码:

public static String getSessionId(HttpServletRequest request)
{
    String sessionId = "";
    String logMsg = "";
    if (request != null)
    {
        String sessionTimeout = PropertiesReader.SESSION_TIMEOUT_SCHEMA;
        if (sessionTimeout != null && SessionHelper.SESSION_TIMEOUT_FIXED.equalsIgnoreCase(sessionTimeout))
        {
            logMsg = "FIXED: Getting SessionId from Cookies with activating the session";
            Cookie[] cookies = request.getCookies();
            if (cookies != null)
            {
                for (Cookie cook : cookies)
                {
                    if ("JSESSIONID".equalsIgnoreCase(cook.getName()))
                    {
                        sessionId = cook.getValue();
                        break;
                    }
                }
            }
        } else
        {
            logMsg = "PER_USAGE: Getting SessionId from Session";
            sessionId = request.getSession(false) != null ? request.getSession(false).getId() : "";
        }
    }else
    {
        logMsg = "Request object is null";
    }

    logger.info(logMsg + ", sessionId=" + sessionId);

    return sessionId;
}

一个OC4J应用服务器,它工作正常.虽然在另一个oc4j服务器上,访问cookie的代码使会话保持活动状态,但不会超时!

编辑:

我真的坚持了!,我试图放置afilter来移除JSESSIONID cookie并从HttpServletRequest中删除所有cookie,但是当我在传递给servlet的请求上调用getSession(false)时,我得到了一个有效的Session!

class CookieRemovalHttpServletRequestWrapper extends HttpServletRequestWrapper
    {
        public static final String COOKIE_HEADER = "cookie";
        public static final String JSESSIONID = "JSESSIONID";

        public CookieRemovalHttpServletRequestWrapper(HttpServletRequest request)
        {
            super(request);
        }

        @Override
        public String getHeader(String name)
        {
            if (COOKIE_HEADER.equalsIgnoreCase(name))
            {
                return "";
            }
            return super.getHeader(name);
        }

        @Override
        public Enumeration getHeaderNames()
        {
            Enumeration e = super.getHeaderNames();
            List l = new ArrayList();
            while (e.hasMoreElements())
            {
                String headerName = (String) e.nextElement();
                if (!COOKIE_HEADER.equalsIgnoreCase(headerName))
                {
                    l.add(headerName);
                }
            }

            return Collections.enumeration(l);
        }

        @Override
        public Enumeration getHeaders(String name)
        {
            if (COOKIE_HEADER.equalsIgnoreCase(name))
            {
                return new Enumeration()
                {
                    public boolean hasMoreElements()
                    {
                        return false;
                    }

                    public Object nextElement()
                    {
                        return null;
                    }
                };
            }
            return super.getHeaders(name);
        }

        @Override
        public Cookie[] getCookies()
        {
            Cookie[] cs = super.getCookies();
            List<Cookie> cokRet = new ArrayList<Cookie>(cs.length);
            for (Cookie c : cs)
            {
                if (c.getName().equalsIgnoreCase(JSESSIONID)) continue;
                cokRet.add(c);
            }

            return cokRet.toArray(new Cookie[] {});
        }

    }

并且真的想要忘记关于Session的所有内容并且只使用会话ID作为用户的唯一标识符,并且自己很难完成.

Answer 1

至于你的代码,不这样做硬盘的方式,使用HttpServletRequest#getRequestedSessionId()和 HttpServletRequest#isRequestedSessionIdValid(),而不是检查请求的会话ID,如果它是有效的.

if (request.getRequestedSessionId() != null && !request.isRequestedSessionIdValid()) {
    // The session has been expired (or a hacker supplied a fake cookie).
}

至于你的具体问题:

访问cookie的代码使会话保持活动状态,不会超时!

不,代码不会这样做.这是HTTP请求本身就是这样做的.无论何时不打电话getSession()或其他事情,都不会推迟会话超时.无论您是否需要代码中的会话,它都将在客户端触发的每个HTTP请求上推迟.

要了解会话如何工作,您可能会发现这个答案很有用:servlet如何工作？实例化,会话,共享变量和多线程