shiro session timeout配置方式

AbstractNativeSessionManager具体实现了SessionManager的行为和NativeSessionManager的行为

具备了Session监听器，session创建时监听器起作用

具体实现SessionManager的行为之 Session start(SessionContext context);

public Session start(SessionContext context) {
    // 抽象创建Session的行为，后文详解#1
    Session session = createSession(context);
    // 为Session设置过期时间，后文详解#2
    applyGlobalSessionTimeout(session);
    // 开启Session中的行为，后文详解#3
    onStart(session, context);
    // 通知监听器执行Session创建中行为，后文详解#4
    notifyStart(session);
    // 包装Session，最终要实现的Session可以存储在除了内存外的其他介质中（如Redis），后文详解#5
    return createExposedSession(session, context);
}

书接前文#1

创建session的过程也会经过几道工序，所以需要抽象，让其子类在创建Session的过程中执行自身特有的行为

protected abstract Session createSession(SessionContext context) throws AuthorizationException;

AbstractValidatingSessionManager执行创建Session的行为

protected Session createSession(SessionContext context) throws AuthorizationException {
// 如果有必要的话对Session进行有效性校验
    enableSessionValidationIfNecessary();
// 具体创建Session的行为，继续抽象化
    return doCreateSession(context);
}

protected abstract Session doCreateSession(SessionContext initData) throws AuthorizationException;

DefaultSessionManager具体执行创建Session的工作，因为其有SessionFactory和SessionDao其具体职能就是创建Session

protected Session doCreateSession(SessionContext context) {
    Session s = newSessionInstance(context);
    if (log.isTraceEnabled()) {
        log.trace("Creating session for host {}", s.getHost());
    }
    create(s);
    return s;
}

// SessionFactory负责创建基础Session
protected Session newSessionInstance(SessionContext context) {
    return getSessionFactory().createSession(context);
}

// SessionDao负责存储Session到介质中
protected void create(Session session) {
    if (log.isDebugEnabled()) {
        log.debug("Creating new EIS record for new session instance [" + session + "]");
    }
    sessionDAO.create(session);
}

书接前文#2

protected void applyGlobalSessionTimeout(Session session) {
    // 从AbstractSessionManager中获得全局Session过期时间，然后为Session设置上
    session.setTimeout(getGlobalSessionTimeout());
    // 执行Session更新时的行为，默认什么都不执行，子类可覆盖执行其特有的行为
    onChange(session);
}

protected void onChange(Session s) {
}

DefaultSessionManager具体执行Session更新时的行为，SessionDao负责更新介质中的Session

protected void onChange(Session session) {
    sessionDAO.update(session);
}

书接前文#3

在开启Session的过程中执行一些行为

protected void onStart(Session session, SessionContext context) {
}

DefaultWebSessionManager在开启Session中创建了Cookie，并在Session中存储了一些内容

protected void onStart(Session session, SessionContext context) {
    super.onStart(session, context);

    if (!WebUtils.isHttp(context)) {
        log.debug("SessionContext argument is not HTTP compatible or does not have an HTTP request/response " +
                "pair. No session ID cookie will be set.");
        return;

    }
    HttpServletRequest request = WebUtils.getHttpRequest(context);
    HttpServletResponse response = WebUtils.getHttpResponse(context);

    if (isSessionIdCookieEnabled()) {
        Serializable sessionId = session.getId();
        storeSessionId(sessionId, request, response);
    } else {
        log.debug("Session ID cookie is disabled.  No cookie has been set for new session with id {}", session.getId());
    }

    request.removeAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE);
    request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_IS_NEW, Boolean.TRUE);
}

书接前文#4

protected void notifyStart(Session session) {
    for (SessionListener listener : this.listeners) {
        listener.onStart(session);
    }
}

书接前文#5

protected Session createExposedSession(Session session, SessionContext context) {
    return new DelegatingSession(this, new DefaultSessionKey(session.getId()));
}

DelegatingSession中具备了NativeSessionManager（SessionManager管理器创建的Session中又包含了SessionManager管理器），Session获得过期时间的过程是这样的：Session.getTimeout() ==> sessionManager.getTimeout(sessionKey) ==> 去Redis或者什么地方获得Session ==> redisSession.getTimeout()

public DelegatingSession(NativeSessionManager sessionManager, SessionKey key) {
    if (sessionManager == null) {
        throw new IllegalArgumentException("sessionManager argument cannot be null.");
    }
    if (key == null) {
        throw new IllegalArgumentException("sessionKey argument cannot be null.");
    }
    if (key.getSessionId() == null) {
        String msg = "The " + DelegatingSession.class.getName() + " implementation requires that the " +
                "SessionKey argument returns a non-null sessionId to support the " +
                "Session.getId() invocations.";
        throw new IllegalArgumentException(msg);
    }
    this.sessionManager = sessionManager;
    this.key = key;
}

具体实现SessionManager的行为之 Session getSession(SessionKey key);

public Session getSession(SessionKey key) throws SessionException {
    // 根据Session的key查找Session（如在Redis介质中查找）
    Session session = lookupSession(key);
    // 如果Session存在就包装Session，最终要实现的Session可以存储在除了内存外的其他介质中（如Redis）
    return session != null ? createExposedSession(session, key) : null;
}

private Session lookupSession(SessionKey key) throws SessionException {
    if (key == null) {
        throw new NullPointerException("SessionKey argument cannot be null.");
    }
    return doGetSession(key);
}

// AbstractNativeSessionManager本身没有查询Session的职能，只能抽象化
protected abstract Session doGetSession(SessionKey key) throws InvalidSessionException;

AbstractValidatingSessionManager又来插一脚发挥其特性，校验Session，其本身也没有查询Session的职能，只能抽象化

protected final Session doGetSession(final SessionKey key) throws InvalidSessionException {
    // 如果有必要的话对Session进行有效性校验
    enableSessionValidationIfNecessary();

    log.trace("Attempting to retrieve session with key {}", key);

    // 根据Session的key检索Session
    Session s = retrieveSession(key);
    if (s != null) {
        // 校验Session
        validate(s, key);
    }
    return s;
}

// AbstractValidatingSessionManager本身没有查询Session的职能，只能抽象化
protected abstract Session retrieveSession(SessionKey key) throws UnknownSessionException;

DefaultSessionManager有SessionDao，查询Session这个事只能是他来做

protected Session retrieveSession(SessionKey sessionKey) throws UnknownSessionException {
    // 获得Session的主键（如Redis的key）
    Serializable sessionId = getSessionId(sessionKey);
    if (sessionId == null) {
        log.debug("Unable to resolve session ID from SessionKey [{}].  Returning null to indicate a " +
                "session could not be found.", sessionKey);
        return null;
    }
    // 从数据源中检索Session
    Session s = retrieveSessionFromDataSource(sessionId);
    if (s == null) {
        //session ID was provided, meaning one is expected to be found, but we couldn't find one:
        String msg = "Could not find session with ID [" + sessionId + "]";
        throw new UnknownSessionException(msg);
    }
    return s;
}

protected Serializable getSessionId(SessionKey sessionKey) {
    return sessionKey.getSessionId();
}

protected Session retrieveSessionFromDataSource(Serializable sessionId) throws UnknownSessionException {
    return sessionDAO.readSession(sessionId);
}

具体实现NativeSessionManager的行为之 Date getStartTimestamp(SessionKey key);

我们先来看DelegatingSession的构造方法，DelegatingSession构造时注入了NativeSessionManager和SessionKey

public DelegatingSession(NativeSessionManager sessionManager, SessionKey key) {
    if (sessionManager == null) {
        throw new IllegalArgumentException("sessionManager argument cannot be null.");
    }
    if (key == null) {
        throw new IllegalArgumentException("sessionKey argument cannot be null.");
    }
    if (key.getSessionId() == null) {
        String msg = "The " + DelegatingSession.class.getName() + " implementation requires that the " +
                "SessionKey argument returns a non-null sessionId to support the " +
                "Session.getId() invocations.";
        throw new IllegalArgumentException(msg);
    }
    this.sessionManager = sessionManager;
    this.key = key;
}

DelegatingSession的 getStartTimestamp()方法

public Date getStartTimestamp() {
    if (startTimestamp == null) {
        // 这件事DelegatingSession本身没有这个职能，只能交给SessionManager去做
        startTimestamp = sessionManager.getStartTimestamp(key);
    }
    return startTimestamp;
}

NativeSessionManager的 getStartTimestamp(SessionKey key)方法

public Date getStartTimestamp(SessionKey key) {
    return lookupRequiredSession(key).getStartTimestamp();
}

private Session lookupRequiredSession(SessionKey key) throws SessionException {
    // 参见上述，根据Session的key获得Session（如去Redis介质中查找），并不像getSession(SessionKey key)那样对Session进行包装
    Session session = lookupSession(key);
    if (session == null) {
        String msg = "Unable to locate required Session instance based on SessionKey [" + key + "].";
        throw new UnknownSessionException(msg);
    }
    return session;
}

SimpleSession中具备了关乎于Session的各种信息他的 getStartTimestamp()方法

public Date getStartTimestamp() {
    return startTimestamp;
}