春季4 - 会话管理

Question

Helle everyone,

i am currently running an enterprise spring web application inside our company deployed on a tomcat 8 server.

Now, some users report that sometimes they can't connect as an login-error is shown on login page.

And well, that's why:

my session-configuration is set up like this:

<session-management>
    <concurrency-control max-sessions="5" 
        error-if-maximum-exceeded="true" expired-url="/login" 
        session-registry-alias="sessionRegistry"/>
</session-management>

<form-login login-processing-url="/login" 
    login-page="/login" 
    authentication-failure-url="/login_error" />

<logout logout-url="/logout" logout-success-url="/login" 
    invalidate-session="true"/> 

the session-timeout is set to 4 hours:

<session-timeout>240</session-timeout> 

• when a user requests the login-page a session with a csfr-token is stored server-side.
• when a user logout, his session is invalidated and he is redirected to the login-page as a new session with csfr-token is stored again server-side.
• when a user has already 5 sessions (different browsers, devices, weird client-behaviour) and tries to login a 6th time - the login is denied, because the session-maximum is exceeded.

Now in a worst case, there are 5 sessions with only csrf-token stored server-side with let's say an avg. lifetime of 3 hours, blocking the user from connecting again.

please, can someone tell me that there is a better solution than:

max-sessions="biggerNumber" 

and Thanks for reading anyway...

Answer 1

You have 2 possibilities that you can combine:

• increase the number of concurrent sessions
• decrease the session timeout (30 minutes is already large)

But you have also a more radical way: change the policy in order not to reject the new connection but revoke the oldest one. It is allowed out of the box by spring-security, just remove error-if-maximum-exceeded="true" from the concurrency-control tag:

<session-management>
    <concurrency-control max-sessions="5" 
        expired-url="/login" 
        session-registry-alias="sessionRegistry"/>
</session-management>

Answer 2

I checked the spring documentation below and tested.

http://docs.spring.io/spring-security/site/docs/current/reference/html/session-mgmt.html#concurrent-sessions

It turns out that you have to add this in your web.xml

<listener>
    <listener-class>
    org.springframework.security.web.session.HttpSessionEventPublisher
    </listener-class>
</listener>

This listener will delete the session connected to principal instance when logging out. Otherwise, the session is still connected to principal instance even after logging out. So that's why you'll keep get the error " Maximum sessions of XX for this principal exceeded".