生产环境频繁被自动退出

title: 生产环境频繁被自动退出 tags:

shiro
redis
lua
事务
kickout categories: 工作日志 date: 2017-05-25 18:18:56

最近发现一个奇怪的现象&＃xff0c;用户登录的时候总是提示

本以为只是正常偶发&＃xff0c;突然最近日志

check了一下登录请求发现如下

192.168.1.170 - - [01/Jun/2017:10:39:10 &＃43;0800] "GET /kzf6/user/login.do?username&＃61;lihuaqixiu&password&＃61;96e79218965eb72c92a549dd5a330112 HTTP/1.1" 200 226 192.168.1.170 - - [01/Jun/2017:10:39:11 &＃43;0800] "GET /kzf6/user/login.do?username&＃61;lihuaqixiu&password&＃61;96e79218965eb72c92a549dd5a330112 HTTP/1.1" 200 226

基本上通过按回车登录的用户均是会出现两条请求&＃xff08;即用户登录了两次<几乎同时>&＃xff09;

那么用户登陆了两次会有啥问题呢&＃xff1f;

参考shiro实现用户踢出功能实现

用户当登录成功后

会调用AuthenticationListener的onSuccess回调。

此时会校验当前用户是否有其他的sessionId存在&＃xff0c;如果存在就按照踢出策略让对应session标记成被踢出&＃xff0c;当回话再次访问时会直接跳到被踢出画面。

其实无论开涛或者我修改后的版本都存在一个问题&＃xff0c;同步。

主要问题在此

while (lop.size(redisListKey) > maxSession) { Serializable kickoutSessionId;if (kickoutAfter) { //如果踢出后者kickoutSessionId &＃61; lop.rightPop(redisListKey);} else { //否则踢出前者kickoutSessionId &＃61; lop.leftPop(redisListKey);}

其实说起来也很明显&＃xff0c;查询和做修改的操作并不是同步的&＃xff0c;比如对于同一个redisKey来说&＃xff08;并发&＃xff09;即很有可能出现意料之外的问题。

那么改善呢也很简单&＃xff0c;对应的根据redisKey来做一把锁&＃xff08;分布式情况较为复杂&＃xff09;恰巧我放系统正是分布式系统。那么如何解决呢&＃xff1f;

和原先一样&＃xff0c;使用redis的lua脚本来完成参考 shiro实现用户踢出功能

改善后代码如下

---- Created by IntelliJ IDEA.-- User: qixiaobo-- Date: 2017/6/2-- Time: 10:24-- 移除session id&＃xff0c;当sessionid数目小于允许登录数这返回空&＃xff0c;使用lua脚本redis操作的保证原子性-- keys[1]对应redis的list的key-- args[1]对应maxSession-- args[2]对应 true:left 或者false: right-- 返回是否存入redislocal list_key &＃61; KEYS[1];local max_session &＃61; ARGV[1];local remove_before &＃61; ARGV[2]local size &＃61; redis.call(&＃39;LLEN&＃39;, list_key);local session_id;if size > tonumber(max_session) thenif remove_before &＃61;&＃61; &＃39;true&＃39; thensession_id &＃61; redis.call(&＃39;LPOP&＃39;, list_key);elsesession_id &＃61; redis.call(&＃39;RPOP&＃39;, list_key);end;end;return session_id;

<bean id&＃61;"removeSessionKey" class&＃61;"org.springframework.data.redis.core.script.DefaultRedisScript"><property name&＃61;"location" value&＃61;"classpath:removeSessionKey.lua"/><property name&＃61;"resultType" value&＃61;"java.lang.String"/>bean>

/*** Created by qixiaobo on 2017/5/22.*/public class KickOutSessionListener implements AuthenticationListener {private static final String SESSION_KEY_KICKOUT &＃61; "kickout";private static final String SESSION_KEY_KICKOUT_TIME &＃61; "kickout_time";private static final String SESSION_KEY_KICKOUT_IP &＃61; "kickout_ip";private static final String REDIS_KEY_PREFIX &＃61; CachingSessionDAO.ACTIVE_SESSION_CACHE_NAME &＃43; ":";private Logger logger &＃61; LoggerFactory.getLogger(KickOutSessionListener.class);private boolean kickoutAfter; //踢出之前登录的/之后登录的用户默认踢出之前登录的用户private int maxSession; //同一个帐号最大会话数默认1private SessionManager sessionManager;&＃64;Autowired&＃64;Qualifier(value &＃61; "stringRedisTemplate")private StringRedisTemplate template;&＃64;Autowiredprivate RedisScript addSessionAndExpireList;&＃64;Autowiredprivate RedisScript removeSessionKey;&＃64;Value("#{T(java.lang.String).valueOf(${session.validation.interval}/1000)}")private String sessionExpire;&＃64;Value("${shiro.kickout}")private boolean enable;&＃64;Overridepublic void onSuccess(AuthenticationToken token, AuthenticationInfo info) {if (enable) {Subject subject &＃61; SecurityUtils.getSubject();HttpServletRequest request &＃61; WebUtils.getHttpRequest(subject);Session session;final String username &＃61; token.getPrincipal().toString();try {session &＃61; subject.getSession();} catch (SessionException ex) {logger.warn(ex.getMessage(), ex);return;}if (session &＃61;&＃61; null) {return;}String sessionId &＃61; (String) session.getId();ListOperations lop &＃61; template.opsForList();final String redisListKey &＃61; getRedisKey(username);//通常情况下 maxSession为1就不判断size了try {List listKey &＃61; Collections.singletonList(redisListKey);if (session.getAttribute(SESSION_KEY_KICKOUT) &＃61;&＃61; null) {template.execute(addSessionAndExpireList, listKey, sessionId, sessionExpire);}//如果队列里的sessionId数超出最大会话数&＃xff0c;开始踢人String kickoutSessionId;while ((kickoutSessionId &＃61; template.execute(removeSessionKey, listKey, String.valueOf(maxSession), String.valueOf(!kickoutAfter))) !&＃61; null) {Session kickoutSession;try {kickoutSession &＃61; sessionManager.getSession(new DefaultSessionKey(kickoutSessionId));} catch (SessionException exception) {logger.warn(exception.getMessage(), exception);kickoutSession &＃61; null;}if (kickoutSession !&＃61; null) {//设置会话的kickout属性表示踢出了kickoutSession.setAttribute(SESSION_KEY_KICKOUT, true);kickoutSession.setAttribute(SESSION_KEY_KICKOUT_TIME, new DateTime().toString(AppConstant.DEFAULT_DATE_FORMAT_PATTERN));kickoutSession.setAttribute(SESSION_KEY_KICKOUT_IP, WxbStatic.getRemoteIp(request));}}} catch (Exception ex) {logger.error(ex.getMessage(), ex);}}}&＃64;Overridepublic void onFailure(AuthenticationToken token, AuthenticationException ae) {}&＃64;Overridepublic void onLogout(PrincipalCollection principals) {}public void setKickoutAfter(boolean kickoutAfter) {this.kickoutAfter &＃61; kickoutAfter;}public void setMaxSession(int maxSession) {this.maxSession &＃61; maxSession;}public void setSessionManager(SessionManager sessionManager) {this.sessionManager &＃61; sessionManager;}public StringRedisTemplate getTemplate() {return template;}public void setTemplate(StringRedisTemplate template) {this.template &＃61; template;}private String getRedisKey(String key) {return REDIS_KEY_PREFIX &＃43; key;}}