java-web - JavaWeb 如何设计用户多个浏览器登陆时只有最新的登陆的有效

问题描述

问 题

例如用户在A浏览器上登陆了，然后用手机打开B浏览器又登陆了，要让A浏览器上的用户退出（用户再次操作时提示登陆即可）
我的设计如下，这样设计有什么问题吗？因为有时候会报错

java.lang.IllegalStateException: getAttribute: Session already invalidated

我的代码：

    //登陆方法
    private void login(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException{
        //验证用户通过
        ....
        //判断当前用户是否已经登陆,如果已经登陆，清掉之前的登陆信息(上次登陆失效);
        if(isAlreadyLogin(user.getId(),request)){
            Map<String,HttpSession> sessionMap = (Map<String, HttpSession>)request.getServletContext().getAttribute("sessionMap");
            try {
                sessionMap.get(user.getId()).removeAttribute("userID");**//这句报错**
                sessionMap.get(user.getId()).removeAttribute("user");
            } catch (Exception e) {
                // TODO Java.lang.IllegalStateException: getAttribute: Session already invalidated
            }
        }
        //登陆成功 ,设置session 
        request.getSession(true).setAttribute("user", user);
        request.getSession(true).setAttribute("userID", user.getId());
        addSessionToMap(user.getId(), request);
        ....
    }
    
    //退出方法
    private void logOut(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException{
        String userId = (String)request.getSession().getAttribute("userID");
        removeSessionToMap(userId,request);
        request.getSession().removeAttribute("userID");
        request.getSession().removeAttribute("user");
        //返回信息
        ......
    }
    
    /**
     * 判断用户是否已经登录
     */
    private static boolean isAlreadyLogin(String userId,HttpServletRequest request){
        ServletContext application = request.getServletContext();
        Map<String,HttpSession> sessionMap = (Map<String,HttpSession>)application.getAttribute("sessionMap");
        if(sessionMap==null||sessionMap.get(userId)==null){
            return false;
        }
        return true;
    }

    private static void addSessionToMap(String userId,HttpServletRequest request){
        ServletContext application = request.getServletContext();
        Map<String,HttpSession> sessionMap = (Map<String,HttpSession>)application.getAttribute("sessionMap");
        if(sessionMap==null){
            sessionMap = new HashMap<String,HttpSession>();
        }
        sessionMap.put(userId, request.getSession());
        application.setAttribute("sessionMap", sessionMap);
    }
    
    private static void removeSessionToMap(String userId,HttpServletRequest request){
        ServletContext application = request.getServletContext();
        Map<String,HttpSession> sessionMap = (Map<String,HttpSession>)application.getAttribute("sessionMap");
        if(sessionMap==null){
            sessionMap = new HashMap<String,HttpSession>();
        }
        sessionMap.remove(userId);
        application.setAttribute("sessionMap", sessionMap);
    }

请大牛指教，谢了。

解决方案

removeAttribute 方法说明

void removeAttribute(java.lang.String name)
Removes the object bound with the specified name from this session. If the session does not have an object bound with the specified name, this method does nothing.
After this method executes, and if the object implements HttpSessionBindingListener, the container calls HttpSessionBindingListener.valueUnbound. The container then notifies any HttpSessionAttributeListeners in the web application.

Parameters:
name - the name of the object to remove from this session
Throws:
IllegalStateException - if this method is called on an invalidated session

很显然session超时失效了，你在失效的session上调用方法就会出现你说的问题了。

这篇关于java-web - JavaWeb 如何设计用户多个浏览器登陆时只有最新的登陆的有效的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！