java用户在其他用户（从另一台计算机）登录时记录更改

Question

我真的需要任何帮助。 我有一个JSF应用程序，在Tomcat6上运行PrimeFaces

我以为我已经完成了应用程序，但在测试时，我发现了一个巨大的问题。 当我使用计算机1中的一个用户（例如“admin”）登录应用程序，然后使用计算机2上的另一个用户（例如“peter”）登录时，计算机1现在无法访问用户admin允许的页面。如果我以后在1号计算机上用管理员用户登录，现在在2号计算机上，peter可以访问所有允许管理员访问的页面

就好像所有的tomcat会话都有一个会话或类似的会话

我搜索了我的应用程序，没有发现@applicationScoped，我有所有@sessionScoped bean

我不知道该怎么办。请帮忙

我在此附上我的定制过滤器：

public abstract class AbstractLoginFilter implements javax.servlet.Filter {

protected ServletContext servletContext;

@Override
public void init(FilterConfig filterConfig) {
    servletContext = filterConfig.getServletContext();
}

@Override
public void doFilter(
        ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {
    HttpServletRequest req = (HttpServletRequest) request;
    HttpServletResponse resp = (HttpServletResponse) response;
    String pageReq = req.getRequestURL().toString();        
    HttpSession session = req.getSession(false);

    String[] temp = pageReq.split("/faces", 2);

    String url = temp[1];
    resp.setCharacterEncoding("UTF-8");
    req.setCharacterEncoding("UTF-8");

    if ("/login.xhtml".equals(url)) { 

        continueExecution(chain, request, response);
    } else {

        if (session == null) {

            //session timeout check.
            if (req.getRequestedSessionId() != null && !req.isRequestedSessionIdValid()) {

                System.out.println("La sesión ha expirado");
                session = req.getSession(true);

                //si es un ajax
                if ("partial/ajax".equals(req.getHeader("Faces-Request"))) {
                    resp.setContentType("text/xml");
                    resp.getWriter().append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>").printf("<partial-response><redirect url=\"%s\"></redirect></partial-response>", "/Autorack/faces/login.xhtml");
                } else {
                    resp.sendRedirect("/Autorack/faces/login.xhtml");
                }
            }
        } else {
            if (Global.getLoggedUser() == null) {
                resp.sendRedirect("/Autorack/faces/login.xhtml");
            } else {
                if (isPublicPage(url) || isAuth(url)) {
                    continueExecution(chain, request, response);
                } else {

                    resp.sendRedirect("/Autorack/faces/noAutorizacion.xhtml");
                }
            }
        }
    }
}

private void continueExecution(FilterChain chain, ServletRequest request, ServletResponse response) throws ServletException, IOException {
    HttpServletRequest req = (HttpServletRequest) request;
    HttpServletResponse resp = (HttpServletResponse) response;

    //when i make a BACK
    if (!req.getRequestURI().startsWith(req.getContextPath() + ResourceHandler.RESOURCE_IDENTIFIER)) { // Skip JSF resources (CSS/JS/Images/etc)
        resp.setHeader("Cache-Control", "no-cache, no-store, must-revalidate"); // HTTP 1.1.
        resp.setHeader("Pragma", "no-cache"); // HTTP 1.0.
        resp.setDateHeader("Expires", 0); // Proxies.
    }
    chain.doFilter(request, response);
}

private boolean isPublicPage(String url) {
    List<String> urlsPublicas = new ArrayList<String>();
    urlsPublicas.add("/inicio.xhtml");
    urlsPublicas.add("/noAutorizacion.xhtml");
    urlsPublicas.add("/usuario/CambioPassword.xhtml");

    return urlsPublicas.contains(url);


}

@Override
public void destroy() {
}

/**
 * logic to accept or reject access to the page, check log in status
 * @return true when authentication is deemed valid
 */
protected abstract boolean isAuth(String reqPage);
}

这是我的网站。xml

<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<filter>
    <description>Customizable Filter</description>
    <filter-name>customFilter</filter-name>
    <filter-class>com.oriuken.autorack.security.LoginFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>customFilter</filter-name>
    <url-pattern>*.xhtml</url-pattern>                
</filter-mapping>
<error-page>
    <error-code>401</error-code>
    <location>/noAutorizacion.xhtml?faces-redirect=true</location>
</error-page>
<context-param>
    <param-name>javax.faces.PROJECT_STAGE</param-name>
    <param-value>Production</param-value>
</context-param>
<servlet>
    <servlet-name>Faces Servlet</servlet-name>
    <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
    <servlet-name>Faces Servlet</servlet-name>
    <url-pattern>/faces/*</url-pattern>
</servlet-mapping>
<session-config>
    <session-timeout>30</session-timeout>
</session-config>
<welcome-file-list>
    <welcome-file>faces/index.xhtml</welcome-file>
</welcome-file-list>
<context-param>
    <param-name>primefaces.THEME</param-name>
    <param-value>casablanca</param-value>
</context-param>
<context-param>
    <param-name>primefaces.PUSH_SERVER_URL</param-name>
    <param-value>ws://localhost:8088</param-value>
</context-param>
<context-param>
<param-name>javax.faces.DATETIMECONVERTER_DEFAULT_TIMEZONE_IS_SYSTEM_TIMEZONE</param-name>
<param-value>true</param-value>

谢谢你的提示

Answer 1

而不是使用

Global.getLoggedUser() 

我们已经实现了一些ThreadLocal来实现同样的效果

下面是一些代码片段，可能会帮助您

public class UserHolder {

private static ThreadLocal<User> userThreadLocal = new ThreadLocal<User>();

private static Log log = LogFactory.getLog(UserHolder.class);

public UserHolder(User user) {
    if (userThreadLocal.get() == null) {
        userThreadLocal.set(user);
        log.debug("User bound to thread " + user.getUsername()); 
    } else {
        log.debug("User already bound to thread " + user.getUsername());
    }
}

public static User getUser() {
    return userThreadLocal.get();
}

public static void setUser(User user) {
        userThreadLocal.set(user);
}

public static void remove() {
    userThreadLocal.remove();
}
}

在应用程序筛选器后身份验证中，我们通过从会话变量读取用户来在UserHolder中设置该用户，如：

 new UserHolder((User) session.getAttribute("USER_ATTR_KEY"));
 // deliver request to next filter
 chain.doFilter(request, response);