如何让jcaptcha与Spring Session一起工作?

Posted

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了如何让jcaptcha与Spring Session一起工作?相关的知识,希望对你有一定的参考价值。

我们实现了由Redis支持的Spring Session,并拥有一个Tomcat服务器集群。当我们通过不设置jvmRoute来关闭粘性会话时,我们在jcaptcha服务中不断收到“文本验证失败”。我假设这是因为jcaptcha servlet对Spring Dispatcher servlet一无所知,后者具有所有Spring Session过滤器,因此无法读取会话变量。我们如何让jcaptcha与Spring Session一起工作?

这是我们的设置:

Veb.hml

<servlet>
    <servlet-name>my-servlet</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>throwExceptionIfNoHandlerFound</param-name>
        <param-value>true</param-value>
    </init-param>
    <load-on-startup>2</load-on-startup>
</servlet>

<servlet-mapping>
    <servlet-name>my-servlet</servlet-name>
    <url-pattern>/</url-pattern>
</servlet-mapping>

<servlet>
    <servlet-name>jcaptcha</servlet-name>
    <servlet-class>com.octo.captcha.module.servlet.image.SimpleImageCaptchaServlet</servlet-class>
</servlet>

<servlet-mapping>
    <servlet-name>jcaptcha</servlet-name>
    <url-pattern>/jcaptcha/jcaptcha.jpg</url-pattern>
</servlet-mapping>

custom HTTP session app initializer.Java

public class CustomHttpSessionAppInitializer extends AbstractHttpSessionApplicationInitializer {}

Redis session config.Java

@Configuration
@EnableRedisHttpSession
public class RedisSessionConfig {

    @Value("${spring.redis.host}")
    private String redisServerName;

    @Value("${spring.redis.port}")
    private Integer redisServerPort;

    @Value("${spring.redis.database}")
    private Integer redisServerDatabase;

    @Value("${spring.redis.password}")
    private String redisServerPassword;

    @Value("${spring.server.affinity}")
    private Boolean isServerAffinity = Boolean.FALSE;

    @Autowired
    private SessionIdentifierService sessionIdentifierService;

    @Bean
    public JedisConnectionFactory jedisConnectionFactory() {
        RedisStandaloneConfiguration config = new RedisStandaloneConfiguration(redisServerName, redisServerPort);
        config.setDatabase(redisServerDatabase);
        config.setPassword(RedisPassword.of(redisServerPassword));
        return new JedisConnectionFactory(config);
    }

    /*
     * We need to register every HttpSessionListener as a bean to translate SessionDestroyedEvent and SessionCreatedEvent into
     * HttpSessionEvent. Otherwise we will got a lot of warning messages about being Unable to publish Events for the session.
     * See Spring Session Docs at:
     * {@link} https://docs.spring.io/spring-session/docs/current/reference/html5/#httpsession-httpsessionlistener
     */
    @Bean
    public HttpSessionEventPublisher httpSessionEventPublisher() {
        return new HttpSessionEventPublisher();
    }

    @Bean
    public CookieSerializer cookieSerializer() {
        DefaultCookieSerializer serializer = new DefaultCookieSerializer();
        serializer.setCookieName("JSESSIONID");
        serializer.setUseBase64Encoding(false);
        if (isServerAffinity) {
            serializer.setJvmRoute(sessionIdentifierService.getJvmRoute());
        }
        return serializer;
    }

    @Bean
    public RedisTemplate<String, Object> redisTemplate() {
        RedisTemplate<String, Object> template = new RedisTemplate<>();
        template.setConnectionFactory(jedisConnectionFactory());
        return template;
    }
}
答案

将jcaptcha与Spring Session集成应该没有问题。只要有一种从Redis加载会话的方法(在这种情况下通过SESSION cookie)并且会话存在,调用request.getSession()request.getSession(false)将返回Redis支持的会话。

这适用于在springSessionRepositoryFilter之后调用的任何过滤器和servlet。如果你看一下SessionRepositoryFilter的源代码,你会看到HttpServletRequestSessionRepositoryRequestWrapper交换。

因此,您使用SimpleImageCaptchaServlet和用于验证用户响应的servlet将获得一个SessionRepositoryRequestWrapper,它将使您无法访问Redis支持的会话。

那么问题可能就是你的配置; springSessionRepositoryFilter可能没有在容器中注册,特别是因为你同时使用web.xml和Servlet 3.0+ WebApplicationInitializer。如果您的应用程序正常运行,那么您的web.xml很可能正常工作。您使用WebApplicationInitializer加载您的web.xml吗?如果没有,那么可能是您的Java Config未加载。确保您的web.xml以某种方式加载您的配置,可能通过在contextLoaderListener xml配置文件中启用组件扫描(<context:component-scan/>)来加载Java Config以及:

<bean class="org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration"/>

加载将创建过滤器的配置,然后必须将其添加到web.xml:

<filter>
    <filter-name>springSessionRepositoryFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSessionRepositoryFilter</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
    <dispatcher>ERROR</dispatcher>
</filter-mapping>

看看Spring Session reference on XML config

以上是关于如何让jcaptcha与Spring Session一起工作?的主要内容,如果未能解决你的问题,请参考以下文章

Spring中使用Jcaptcha实现校验码验证

servlet使用sessio和spring mvc中的controller使用session

JavaWebSSM+SpringSecurity+EhCache+JCaptcha 完整Web基础框架

使用jcaptcha插件生成验证码

jcaptcha进阶

jcaptcha配置验证码