Springsecurity会话在java线程中不可用
我正在开发一个SpringMVC应用程序,其中我们使用SpringSecurity进行身份验证和授权。在某些任务中,我们希望使用线程,但每当我们使用Java线程时,都会尝试获取有关经过身份验证的用户的详细信息
我还尝试了@Async
注释,但它并不是我们所看到的线程中所需要的代码的唯一特定部分
有没有办法在Java线程中注入spring会话?如果没有,请选择在单独线程中运行部分代码的其他方法。多谢各位
示例代码:
public void sendNotification(Notification notification, int memberId) {
Thread thread = new Thread(() -> {
Person onlinePerson = this.personService.getCurrentlyAuthenticatedUser();
GroupMembers groupMembers = this.groupMembersService.getMemberById(memberId);
}
thread.start();
}
现在,在上面的代码中,如果我试图获取任何关于onlinePerson的信息,比如带有onlinePerson的id。getId();,我有一个NPE。查看错误日志:
Exception in thread "Thread-9" java.lang.NullPointerException
at com.project.spring.chat.ChatServiceImpl.lambda$sendNotification$3(ChatServiceImpl.java:532)
at java.lang.Thread.run(Thread.java:745)
你知道我怎么解决这个问题吗。多谢各位
安全应用程序上下文。xml:
<security:http pattern="/resources/**" security="none"/>
<security:http create-session="ifRequired" use-expressions="true" auto-config="false" disable-url-rewriting="true">
<security:form-login login-page="/login" username-parameter="j_username" password-parameter="j_password"
login-processing-url="/j_spring_security_check" default-target-url="/canvaslisting"
always-use-default-target="true" authentication-failure-url="/denied"/>
<security:remember-me key="_spring_security_remember_me" user-service-ref="userDetailsService"
token-validity-seconds="1209600" data-source-ref="dataSource"/>
<security:logout delete-cookies="JSESSIONID" invalidate-session="true" logout-url="/j_spring_security_logout"/>
<!--<security:intercept-url pattern="/**" requires-channel="https"/>-->
<security:port-mappings>
<security:port-mapping http="80" https="443"/>
</security:port-mappings>
<security:logout logout-url="/logout" logout-success-url="/" success-handler-ref="myLogoutHandler"/>
<security:session-management session-fixation-protection="newSession">
<security:concurrency-control session-registry-ref="sessionReg" max-sessions="5" expired-url="/login"/>
</security:session-management>
</security:http>
<beans:bean id="sessionReg" class="org.springframework.security.core.session.SessionRegistryImpl"/>
<beans:bean id="rememberMeAuthenticationProvider"
class="org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices">
<beans:constructor-arg index="0" value="_spring_security_remember_me"/>
<beans:constructor-arg index="1" ref="userDetailsService"/>
<beans:constructor-arg index="2" ref="jdbcTokenRepository"/>
<property name="alwaysRemember" value="true"/>
</beans:bean>
<beans:bean id="jdbcTokenRepository"
class="org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl">
<beans:property name="createTableOnStartup" value="false"/>
<beans:property name="dataSource" ref="dataSource"/>
</beans:bean>
<!-- Remember me ends here -->
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider user-service-ref="LoginServiceImpl">
<security:password-encoder ref="encoder"/>
</security:authentication-provider>
</security:authentication-manager>
<beans:bean id="encoder"
class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
<beans:constructor-arg name="strength" value="11"/>
</beans:bean>
<beans:bean id="daoAuthenticationProvider"
class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
<beans:property name="userDetailsService" ref="LoginServiceImpl"/>
<beans:property name="passwordEncoder" ref="encoder"/>
</beans:bean>
</beans>
# 1 楼答案
这是因为会话信息存储在处理HTTP请求的线程的
ThreadLocal
中。默认情况下,它对新线程不可用(无论是手动创建还是通过@Async
)幸运的是,这很容易配置:
SecurityContextHolder.setStrategyName(SecurityContextHolder.MODE_INHERITABLETHREADLOCAL) //in a context loader listener for example
或使用环境变量:
spring.security.strategy=MODE_INHERITABLETHREADLOCAL
# 2 楼答案
您的thread类不是由spring管理的,因为在您的代码示例中,您可以通过调用其构造函数手动创建类实例。您需要获得由spring管理的线程实例,并使用spring的
ApplicationContext
从bean中检索它。我猜您希望同时运行多个线程实例?如果是这样,您可能需要为每个线程执行一个新的线程实例(bean)。以下是您如何实现这一目标的示例:# 3 楼答案
Runnable
通常用于提供线程应该run
的代码,但是Runnable
本身与线程无关。它只是一个带有run()
方法的对象# 4 楼答案