无法使用 spring boot 在 spring security 中防止来自同一用户的多个并发登录

Question

** 在这里，我编辑了我的代码，以查看我目前正在为此目的使用内存身份验证

这是我的安全配置文件，我想要实现的是让一个用户没有并发会话。 使用此代码，我可以在多个选项卡上使用同一用户登录。 即使用户有一个活跃的会话任何人都可以帮我这个。我是 Spring security 的新手在此先感谢**

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {


    @Autowired
    public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser(username).password(password).roles("OPERATIONAL");
        auth.inMemoryAuthentication().withUser(sysUsername).password(sysPassword).roles("OPERATIONAL");
    }
    
    @Override
    public void configure(WebSecurity web) throws Exception {

        web.ignoring().antMatchers("/initialPage").and().ignoring().antMatchers("/WEB-INF/**").and().ignoring()
                .antMatchers("/sp/processRequest").antMatchers("/WEB-INF/**").and().ignoring()
                .antMatchers("/sp/rest/getChannelCodeOnMID").antMatchers("/createRazorpayOrder").and().ignoring()
                .antMatchers("/createRazorpayOrder").antMatchers("/sp/rest/getNonPreferredEntities").and().ignoring()
                .antMatchers("/sp/rest/getNonPreferredEntities").antMatchers("/sp/rest/getChargesDetailsOnChannel")
                .and().ignoring().antMatchers("/sp/rest/getChargesDetailsOnChannel").antMatchers("/paymentResponse")
                .and().ignoring().antMatchers("/paymentResponse").antMatchers("/RedirectpaymentResponse").and()
                .ignoring().antMatchers("/RedirectpaymentResponse").and().ignoring().antMatchers("/testMerchantPage")
                .and().ignoring().antMatchers("/sp/rest/generateChecksum").and().ignoring().antMatchers("/pushResponse")
                .and().ignoring().antMatchers("/sp/rest/getServiceDetails")
                .and().ignoring().antMatchers("/errorPage")
                .and().ignoring().antMatchers("/getResponse")
                .and().ignoring().antMatchers("/css/**")
                .and().ignoring().antMatchers("/js/**")
                .and().ignoring().antMatchers("/img/qrcode/**")
                .and().ignoring().antMatchers("/sp/rest/getCancelRequest")
                .and().ignoring().antMatchers("/sp/rest/checkTxnStatusOnOrderId")
                .and().ignoring().antMatchers("/pushResponse")
                .and().ignoring().antMatchers("/paymentStatusApi");
        
    }

    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        
        http.csrf().requireCsrfProtectionMatcher(new AntPathRequestMatcher("**/login")).and().authorizeRequests().antMatchers("**/api/v1/getPricingDtls").permitAll()
        .antMatchers("/merchantCreationOrView").hasRole("OPERATIONAL").and().authorizeRequests()
        .antMatchers("/merchantCreation").hasRole("OPERATIONAL")
        .antMatchers("/merchantView").hasRole("OPERATIONAL")
        .antMatchers("/merchantRenderedView").hasRole("OPERATIONAL")
        .antMatchers("/viewMerchantDetails").hasRole("OPERATIONAL")
        .antMatchers("/saveMerchantDetails").hasRole("OPERATIONAL")
        .antMatchers("/download").hasRole("OPERATIONAL")
        .antMatchers("/downloadSettlement").hasRole("OPERATIONAL")
        .and().formLogin().loginPage("/login").
        defaultSuccessUrl("/merchantCreationOrView",true).failureUrl("/login?error").permitAll()
        .and()
          .sessionManagement()
          .sessionCreationPolicy(SessionCreationPolicy.NEVER)
          .maximumSessions(1)
          .maxSessionsPreventsLogin(true).
          sessionRegistry(sessionRegistry())
          ;
    }

    @Bean
    SessionRegistry sessionRegistry() {         
        return new SessionRegistryImpl();
    }
    @Bean
    public static ServletListenerRegistrationBean httpSessionEventPublisher() { //(5)
        return new ServletListenerRegistrationBean(new HttpSessionEventPublisher());
    }
    
    
    
    @Bean
    public CustomBasicAuthenticationEntryPoint getBasicAuthenticationEntryPoint() {
        
        return new CustomBasicAuthenticationEntryPoint();
    }
    

    

}

Answer 1

简单的检查可以帮助您在这里解决类似的问题。

您很可能没有在登录的User类中实现/覆盖正确的hashCode和equals方法。

你必须做这样的事情，取决于你如何逻辑地确定所谓的“相同”用户：

 public class User implements UserDetails, Serializable {
    private static final long serialVersionUID = 1L;

    // ...

    @Override
    public boolean equals(Object obj) {
        if (obj instanceof User) {
          return username.equals( ((User) obj).getUsername() );
        }
        return false;
    }

    @Override
    public int hashCode() {
        return username != null ? username.hashCode() : 0;
    }
}