From 82be6bbf698fb346791c38d6f688ccfaa580a916 Mon Sep 17 00:00:00 2001
From: winLsy <18332763730@163.com>
Date: Wed, 17 Jan 2018 18:52:48 +0800
Subject: [PATCH] =?UTF-8?q?session=E5=B9=B6=E5=8F=91=E7=99=BB=E5=BD=95?=
 =?UTF-8?q?=E5=A4=84=E7=90=86?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../boot-starter-security-browser/README.md   |  3 +++
 .../browser/config/BrowserSecurityConfig.java |  8 ++++++++
 .../session/MsExpiredSessionStrategy.java     | 19 +++++++++++++++++++
 .../src/main/resources/application.yml        |  2 +-
 4 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/session/MsExpiredSessionStrategy.java

diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/README.md b/boot-starter/boot-starter-security/boot-starter-security-browser/README.md
index 9243c62..47131b1 100644
--- a/boot-starter/boot-starter-security/boot-starter-security-browser/README.md
+++ b/boot-starter/boot-starter-security/boot-starter-security-browser/README.md
@@ -14,4 +14,7 @@
 - 第三方登陆时，当用户不存在的时候，如果想要系统自动注册一个用户，不进行跳转的话。声明一个类似于demo项目中DemoConnectionSignUp
 样的组件进行自己用户体系的注册。这里的注册指的是创建本系统自己的用户体系，第三方的用户体系springSocial会自动帮助我们创建。授权后
 直接跳转到域名首页
+### session管理
+- session过期的处理  @GetMapping("/session/invalid")
+- 用户并发登录的处理MsExpiredSessionStrategy
   
\ No newline at end of file
diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java
index d604ab3..dad5370 100644
--- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java
+++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java
@@ -1,5 +1,6 @@
 package com.micro.fast.security.browser.config;
 
+import com.micro.fast.security.browser.session.MsExpiredSessionStrategy;
 import com.micro.fast.security.core.authentication.mobile.SmsCodeAuthenticationSecurityConfig;
 import com.micro.fast.security.core.master.SecurityConstants;
 import com.micro.fast.security.core.master.SecurityProperties;
@@ -122,6 +123,13 @@ public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
         .sessionManagement()
         //定义session过期的时候处理的url
         .invalidSessionUrl("/session/invalid")
+        //session存在的最大数量
+        .maximumSessions(1)
+        //设置session被替换掉时处理逻辑
+        .expiredSessionStrategy(new MsExpiredSessionStrategy())
+        //设置不允许第二个用户登录，不设置这句话的话，会替换掉上一个登录用户
+        .maxSessionsPreventsLogin(true)
+        .and()
         .and()
         .authorizeRequests()//下面是权限配置
         //当访问这个页面的时候不进行身份认证,对用户自定义的登录页也不进行权限认证
diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/session/MsExpiredSessionStrategy.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/session/MsExpiredSessionStrategy.java
new file mode 100644
index 0000000..53a885a
--- /dev/null
+++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/session/MsExpiredSessionStrategy.java
@@ -0,0 +1,19 @@
+package com.micro.fast.security.browser.session;
+
+import org.springframework.security.web.session.SessionInformationExpiredEvent;
+import org.springframework.security.web.session.SessionInformationExpiredStrategy;
+
+import javax.servlet.ServletException;
+import java.io.IOException;
+
+/**
+ * 处理session顶替的策略
+ * @author lsy
+ */
+public class MsExpiredSessionStrategy implements SessionInformationExpiredStrategy {
+    @Override
+    public void onExpiredSessionDetected(SessionInformationExpiredEvent sessionInformationExpiredEvent) throws IOException, ServletException {
+        sessionInformationExpiredEvent.getResponse().setContentType("application/json;charset=UTF-8");
+        sessionInformationExpiredEvent.getResponse().getWriter().write("并发登录");
+    }
+}
diff --git a/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml b/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml
index 4a89526..488c6e7 100644
--- a/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml
+++ b/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml
@@ -24,5 +24,5 @@ ms:
 server:
   session:
 #  超时时间，单位是秒，但是不能小于一分钟
-    timeout: 120
+    timeout: 600