java.lang.IllegalStateException：getAttributeNames：會話已經失效春季安全HttpSessionDestroyedEvent

Question

，當我試圖處理SessionDestroyEvent此異常情況：

public class SessionEndedListener implements ApplicationListener<SessionDestroyedEvent> { 
    private final ContractorService contractorService; 

    @Autowired 
    public SessionEndedListener(ContractorService contractorService) { 
     this.contractorService = contractorService; 
    } 

    @Override 
    public void onApplicationEvent(SessionDestroyedEvent sessionDestroyedEvent) { 
     sessionDestroyedEvent.getSecurityContexts() 
    } 
} 

它的發生是因爲在SessionDestroyedEvent會話已經失效。 但在HttpSessionEventPublisher會話有效。

java.lang.IllegalStateException: getAttributeNames: Session already invalidated 
    at org.apache.catalina.session.StandardSession.getAttributeNames(StandardSession.java:1199) 
    at org.apache.catalina.session.StandardSessionFacade.getAttributeNames(StandardSessionFacade.java:120) 
    at org.springframework.security.web.session.HttpSessionDestroyedEvent.getSecurityContexts(HttpSessionDestroyedEvent.java:51) 
    at com.ordotrans.util.listener.SessionEndedListener.onApplicationEvent(SessionEndedListener.java:29) 
    at com.ordotrans.util.listener.SessionEndedListener.onApplicationEvent(SessionEndedListener.java:18) 
    at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:159) 
    at org.springframework.context.event.SimpleApplicationEventMulticaster$1.run(SimpleApplicationEventMulticaster.java:134) 
    at java.lang.Thread.run(Thread.java:745) 

Answer 1

我找到了解決方案，但它看起來像一個柺杖。

@WebListener 
public class SessionCounterListener implements HttpSessionListener { 

    @Override 
    public void sessionCreated(HttpSessionEvent httpSessionEvent) { 
     HttpSession session = httpSessionEvent.getSession(); 
     session.setMaxInactiveInterval(60*15); 
    } 

    @Override 
    public void sessionDestroyed(HttpSessionEvent httpSessionEvent) { 

     HttpSession session = httpSessionEvent.getSession(); 
     SessionDestroyedEvent sessionDestroyedEvent = new HttpSessionDestroyedEvent(session); 
     ApplicationContext ctx = 
       WebApplicationContextUtils. 
         getWebApplicationContext(session.getServletContext()); 
     ContractorService contractorService = (ContractorService) ctx.getBean("contractorService"); 
     for (SecurityContext securityContext : sessionDestroyedEvent.getSecurityContexts()) { 
      Authentication authentication = securityContext.getAuthentication(); 
      CustomUserDetails customUserDetails = (CustomUserDetails) authentication.getPrincipal(); 

     } 

    } 

}