《Apache Shiro 源码解析》- 7.会话

void CookieManager::setCookie(const String& cookieString, const URL& url)
{
    // 解析 Cookie 字符串
    RefPtr<Cookie> cookie = Cookie::create(cookieString, url);

    // 检查是否是 Session Cookie（没有设置 Expires 属性）
    if (cookie->expiresAt().isNull()) {
        // Session Cookie
        m_sessionCookies.append(cookie);
    } else {
        // 持久化 Cookie
        m_persistentCookies.append(cookie);
    }
}

void CookieManager::addCookiesToRequest(WebCore::ResourceRequest& request)
{
    // 获取请求的 URL
    const URL& url = request.url();

    // 选择与请求 URL 匹配的 Cookie
    Vector<RefPtr<Cookie>> cookiesToSend;
    for (const auto& cookie : m_sessionCookies) {
        if (cookie->matches(url)) {
            cookiesToSend.append(cookie);
        }
    }

    // 将 Cookie 添加到请求头
    if (!cookiesToSend.isEmpty()) {
        String cookieHeader = "Cookie: ";
        for (const auto& cookie : cookiesToSend) {
            cookieHeader += cookie->name() + "=" + cookie->value() + "; ";
        }
        request.setHTTPHeaderField(HTTPHeaderName::Cookie, cookieHeader);
    }
}

#include <wtf/text/WTFString.h>
#include <wtf/RefCounted.h>
#include <wtf/URL.h>
#include <wtf/Time.h>

class Cookie : public RefCounted<Cookie> {
public:
    // 构造函数
    Cookie(const String& name, const String& value, const String& domain, const String& path, bool isSecure, bool isHttpOnly, WallTime expiry)
        : m_name(name)
        , m_value(value)
        , m_domain(domain)
        , m_path(path)
        , m_isSecure(isSecure)
        , m_isHttpOnly(isHttpOnly)
        , m_expiry(expiry)
    {
    }

    // 获取 cookie 的基本属性
    const String& name() const { return m_name; }
    const String& value() const { return m_value; }
    const String& domain() const { return m_domain; }
    const String& path() const { return m_path; }
    bool isSecure() const { return m_isSecure; }
    bool isHttpOnly() const { return m_isHttpOnly; }
    WallTime expiry() const { return m_expiry; }

    // 检查该 cookie 是否已过期
    bool isExpired() const {
        return WallTime::now() >= m_expiry;
    }

    // 检查该 cookie 是否与给定的 URL 匹配
    bool matches(const URL& url) const {
        if (isExpired())
            return false;

        // 检查域名是否匹配
        if (!url.host().endsWith(m_domain))
            return false;

        // 检查路径是否匹配
        if (!url.path().startsWith(m_path))
            return false;

        // 检查是否需要安全连接
        if (m_isSecure && !url.protocolIs("https"))
            return false;

        return true;
    }

private:
    String m_name;
    String m_value;
    String m_domain;
    String m_path;
    bool m_isSecure;
    bool m_isHttpOnly;
    WallTime m_expiry;
};

class NetworkSession {
  public:
      static Ref<NetworkSession> create(SessionID, const NetworkProcess&, PAL::SessionID);

      SessionID sessionID() const { return m_sessionID; }

      //注意这里，实际上在使用 Cookie
      CookieStorage& cookieStorage() { return m_cookieStorage; }

      void close();

  private:
      SessionID m_sessionID;
      Ref<CookieStorage> m_cookieStorage;
};

class CookieStorage {
  public:
      void setCookie(const URL& url, const Cookie& cookie);
      Vector<Cookie> cookiesForURL(const URL& url) const;

  private:
      HashMap<String, Cookie> m_cookies;
};

Set-Cookie: JSESSIONID=abc123; Path=/; HttpOnly

Set-Cookie: JSESSIONID=abc123; Path=/; HttpOnly; Max-Age=86400

public class HttpServletSession implements Session {

    //...

    private HttpSession httpSession = null;

    public HttpServletSession(HttpSession httpSession, String host) {
        if (httpSession == null) {
            String msg = "HttpSession constructor argument cannot be null.";
            throw new IllegalArgumentException(msg);
        }
        if (httpSession instanceof ShiroHttpSession) {
            String msg = "HttpSession constructor argument cannot be an instance of ShiroHttpSession.  This " +
                    "is enforced to prevent circular dependencies and infinite loops.";
            throw new IllegalArgumentException(msg);
        }
        this.httpSession = httpSession;
        if (StringUtils.hasText(host)) {
            setHost(host);
        }
    }

    //...
}

protected Session createSession(SessionContext sessionContext) throws AuthorizationException {
    if (!WebUtils.isHttp(sessionContext)) {
        String msg = "SessionContext must be an HTTP compatible implementation.";
        throw new IllegalArgumentException(msg);
    }

    HttpServletRequest request = WebUtils.getHttpRequest(sessionContext);

    HttpSession httpSession = request.getSession();

    //SHIRO-240: DO NOT use the 'globalSessionTimeout' value here on the acquired session.
    //see: https://issues.apache.org/jira/browse/SHIRO-240

    String host = getHost(sessionContext);

    return createSession(httpSession, host);
}

protected Session createSession(HttpSession httpSession, String host) {
    return new HttpServletSession(httpSession, host);
}

package org.apache.shiro.web.servlet;

import org.apache.shiro.session.InvalidSessionException;
import org.apache.shiro.session.Session;
import org.apache.shiro.web.session.HttpServletSession;

import javax.servlet.ServletContext;
import javax.servlet.http.HttpServletRequest;
**import javax.servlet.http.HttpSession;**
import javax.servlet.http.HttpSessionBindingEvent;
import javax.servlet.http.HttpSessionBindingListener;
import java.util.*;

public HttpSession getSession(boolean create) {

    HttpSession httpSession;

    if (isHttpSessions()) {
        httpSession = super.getSession(false);
        if (httpSession == null && create) {
            //Shiro 1.2: assert that creation is enabled (SHIRO-266):
            if (WebUtils._isSessionCreationEnabled(this)) {
                httpSession = super.getSession(create);
            } else {
                throw newNoSessionCreationException();
            }
        }
    } else {
        boolean existing = getSubject().getSession(false) != null;

        if (this.session == null || !existing) {
            Session shiroSession = getSubject().getSession(create);
            if (shiroSession != null) {
                this.session = new ShiroHttpSession(shiroSession, this, this.servletContext);
                if (!existing) {
                    setAttribute(REFERENCED_SESSION_IS_NEW, Boolean.TRUE);
                }
            } else if (this.session != null) {
                this.session = null;
            }
        }
        httpSession = this.session;
    }

    return httpSession;
}

public class SimpleSession implements ValidatingSession, Serializable {
    //...

    private transient Serializable id;
    private transient Date startTimestamp;
    private transient Date stopTimestamp;
    private transient Date lastAccessTime;
    private transient long timeout;
    private transient boolean expired;
    private transient String host;

    //这是关键的一行代码，
    private transient Map<Object, Object> attributes;
}

package com.nicefish.rbac.shiro.session;

import com.nicefish.rbac.jpa.entity.NiceFishSessionEntity;
import com.nicefish.rbac.service.INiceFishSessionService;
import org.apache.shiro.session.Session;
import org.apache.shiro.session.mgt.SimpleSession;
import org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.util.ObjectUtils;

import java.io.Serializable;
import java.util.Date;

/**
 * 扩展 Shiro 内置的 EnterpriseCacheSessionDAO ，操作 MySQL 中的 nicefish_rbac_session 表。
 *
 * 由于 EnterpriseCacheSessionDAO 实现了 CacheManagerAware 接口， Shiro 的 SecurityManager 会自动把
 * CacheManager 缓存实例注入到此类中，所以此类中可以直接操作 cacheManager 缓存实例。
 *
 * 此实现参考了 spring-session-jdbc 的实现，Session 中的所有 attributes 都会被提取出来并存储到 SESSION_DATA 列中，
 * 存储格式是 JSON 字符串。
 *
 * 此实现不会存储 Session 实例序列化之后的二进制数据，因为在跨业务模块共享 Session 时，如果 Session 中包含了
 * 某项目中特有的类，那么其它项目在反序列化时会因为找不到 Java 类而失败。
 *
 * @author 大漠穷秋
 */
public class NiceFishSessionDAO extends EnterpriseCacheSessionDAO {
    private static final Logger logger = LoggerFactory.getLogger(NiceFishSessionDAO.class);

    @Autowired
    private INiceFishSessionService sessionService;

    /**
     * 该方法参数中的 session 实例实际上是由 NiceFishSessionFactory.createSession 提供的。
     * 运行时调用轨迹：
     * SecurityManager -> SessionManager -> SessionFactory.createSession() -> EnterpriseCacheSessionDAO.doCreate(session)
     * @param session
     * @return
     */
    @Override
    protected Serializable doCreate(Session session) {
        Serializable sessionId = super.doCreate(session);

        NiceFishSessionEntity entity = new NiceFishSessionEntity();
        entity.setSessionId((String) sessionId);
        entity.setCreationTime(new Date());
        entity.setLastAccessTime(new Date());
        entity.setTimeout(session.getTimeout());

        //TODO:把用户对应的 Role 和 Permission 存储到 Session 中。

        this.sessionService.saveSession(entity);
        return sessionId;
    }

    /**
     * 从 MySQL 数据库中读取 Session ，父层实现会保证先读取缓存，然后再调用此方法。
     * @param sessionId
     * @return
     */
    @Override
    protected Session doReadSession(Serializable sessionId) {
        //把 entity 上的数据拷贝给 session 实例，TODO: 有更好的工具？
        NiceFishSessionEntity entity = sessionService.findDistinctBySessionId(sessionId.toString());
        if(ObjectUtils.isEmpty(entity)){
            return null;
        }

        SimpleSession session=new SimpleSession();
        session.setId(entity.getSessionId());
        session.setTimeout(entity.getTimeout());
        session.setStartTimestamp(entity.getCreationTime());
        session.setLastAccessTime(entity.getLastAccessTime());
        session.setHost(entity.getHost());
        session.setAttribute("appName",entity.getAppName());
        session.setAttribute("userId",entity.getUserId());
        session.setAttribute("userName",entity.getUserName());
        session.setAttribute("exprityTime",entity.getExpiryTime());
        session.setAttribute("maxInactiveInterval",entity.getMaxInactiveInteval());
        session.setExpired(entity.isExpired());
        session.setAttribute("os",entity.getOs());
        session.setAttribute("browser",entity.getBrowser());
        session.setAttribute("userAgent",entity.getUserAgent());
        session.setAttribute("sessionData",entity.getSessionData());
        return session;
    }

    /**
     * 把 Session 更新到 MySQL 数据库，父层实现会保证先更新缓存，然后再调用此方法。
     * 把 SimpleSession 上的数据拷贝给 entity ，然后借助于 entity 更新数据库记录。
     * TODO: 有更好的工具？
     * @param session 类型实际上是 Shiro 的 SimpleSession
     */
    @Override
    protected void doUpdate(Session session) {
        logger.debug("update session..."+session.toString());

        SimpleSession simpleSession=(SimpleSession)session;//Shiro 顶级 Session 接口中没有定义 isExpired() 方法，这里强转成 SimpleSession
        String sessionId=(String)simpleSession.getId();
        NiceFishSessionEntity entity=this.sessionService.findDistinctBySessionId(sessionId);
        if(ObjectUtils.isEmpty(entity)){
            entity=new NiceFishSessionEntity();
            entity.setSessionId((String)simpleSession.getId());
        }
        entity.setHost(simpleSession.getHost());
        entity.setCreationTime(simpleSession.getStartTimestamp());
        entity.setLastAccessTime(simpleSession.getLastAccessTime());
        entity.setTimeout(simpleSession.getTimeout());
        entity.setExpired(simpleSession.isExpired());
        entity.setAppName((String)simpleSession.getAttribute("appName"));
        entity.setUserId((Integer)simpleSession.getAttribute("userId"));
        entity.setUserName((String)simpleSession.getAttribute("userName"));
        entity.setExpiryTime((Date)simpleSession.getAttribute("exprityTime"));
        entity.setMaxInactiveInteval((Integer)simpleSession.getAttribute("maxInactiveInterval"));
        entity.setOs((String)simpleSession.getAttribute("os"));
        entity.setBrowser((String)simpleSession.getAttribute("browser"));
        entity.setUserAgent((String)simpleSession.getAttribute("userAgent"));
        entity.setSessionData((String)simpleSession.getAttribute("sessionData"));
        this.sessionService.saveSession(entity);
    }

    /**
     * 把 Session 从 MySQL 数据库中删除，父层实现会保证先删除缓存，然后再调用此方法。
     * NiceFish 不进行物理删除，仅仅把标志位设置成过期状态。
     * @param session 类型实际上是 Shiro 的 SimpleSession
     */
    @Override
    protected void doDelete(Session session) {
        logger.debug("delete session..."+session.toString());

        NiceFishSessionEntity entity=this.sessionService.findDistinctBySessionId((String)session.getId());
        entity.setExpired(true);
        this.sessionService.saveSession(entity);
    }
}

protected SessionManager createSessionManager(String sessionMode) {
    if (sessionMode == null || !sessionMode.equalsIgnoreCase(NATIVE_SESSION_MODE)) {
        log.info("{} mode - enabling ServletContainerSessionManager (HTTP-only Sessions)", HTTP_SESSION_MODE);
        return new ServletContainerSessionManager();
    } else {
        log.info("{} mode - enabling DefaultWebSessionManager (non-HTTP and HTTP Sessions)", NATIVE_SESSION_MODE);
        return new DefaultWebSessionManager();
    }
}

@Bean
public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);
    shiroFilterFactoryBean.setLoginUrl(loginUrl);
    shiroFilterFactoryBean.setUnauthorizedUrl(unauthorizedUrl);

    Map<String, Filter> filters = new LinkedHashMap<String, Filter>();
    filters.put("captchaValidateFilter", captchaValidateFilter());
    shiroFilterFactoryBean.setFilters(filters);

    //所有静态资源交给Nginx管理，这里只配置与 shiro 相关的过滤器。
    LinkedHashMap<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
    filterChainDefinitionMap.put("/nicefish/cms/post/write-post", "captchaValidateFilter");
    filterChainDefinitionMap.put("/nicefish/cms/post/update-post", "captchaValidateFilter");
    filterChainDefinitionMap.put("/nicefish/cms/comment/write-comment", "captchaValidateFilter");
    filterChainDefinitionMap.put("/nicefish/auth/user/register", "anon,captchaValidateFilter");
    filterChainDefinitionMap.put("/nicefish/auth/shiro/login", "anon,captchaValidateFilter");
    filterChainDefinitionMap.put("/**", "anon");

    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}

public class ShiroFilterFactoryBean implements FactoryBean<AbstractShiroFilter>, BeanPostProcessor

protected ServletRequest wrapServletRequest(HttpServletRequest orig) {
    return new ShiroHttpServletRequest(orig, getServletContext(), isHttpSessions());
}

protected ServletResponse wrapServletResponse(HttpServletResponse orig, ShiroHttpServletRequest request) {
    return new ShiroHttpServletResponse(orig, getServletContext(), request);
}

public HttpSession getSession(boolean create) {
    HttpSession httpSession;
    if (this.isHttpSessions()) {
        httpSession = super.getSession(false);
        if (httpSession == null && create) {
            if (!WebUtils._isSessionCreationEnabled(this)) {
                throw this.newNoSessionCreationException();
            }

            httpSession = super.getSession(create);
        }
    } else {
        boolean existing = this.getSubject().getSession(false) != null;
        if (this.session == null || !existing) {
            Session shiroSession = this.getSubject().getSession(create);
            if (shiroSession != null) {
                this.session = new ShiroHttpSession(shiroSession, this, this.servletContext);
                if (!existing) {
                    this.setAttribute(REFERENCED_SESSION_IS_NEW, Boolean.TRUE);
                }
            } else if (this.session != null) {
                this.session = null;
            }
        }

        httpSession = this.session;
    }

    return httpSession;
}

@Bean
public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);
    shiroFilterFactoryBean.setLoginUrl(loginUrl);
    shiroFilterFactoryBean.setUnauthorizedUrl(unauthorizedUrl);

    Map<String, Filter> filters = new LinkedHashMap<String, Filter>();
    filters.put("captchaValidateFilter", captchaValidateFilter());
    shiroFilterFactoryBean.setFilters(filters);

    //所有静态资源交给Nginx管理，这里只配置与 shiro 相关的过滤器。
    LinkedHashMap<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
    filterChainDefinitionMap.put("/nicefish/cms/post/write-post", "captchaValidateFilter");
    filterChainDefinitionMap.put("/nicefish/cms/post/update-post", "captchaValidateFilter");
    filterChainDefinitionMap.put("/nicefish/cms/comment/write-comment", "captchaValidateFilter");
    filterChainDefinitionMap.put("/nicefish/auth/user/register", "anon,captchaValidateFilter");
    filterChainDefinitionMap.put("/nicefish/auth/shiro/login", "anon,captchaValidateFilter");
    filterChainDefinitionMap.put("/**", "anon");

    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}