今天 項(xiàng)目需要用戶退出的時(shí)候記錄登出日志，修改用戶的登錄狀態(tài)

<?xml version="1.0" encoding="UTF-8"?><beans:beans xmlns="http://www.sPRingframework.org/schema/security"	xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd                          http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd">	<global-method-security pre-post-annotations="enabled" />	<!-- HTTP安全配置 -->	<http auto-config="false" entry-point-ref="authenticationEntryPoint"  access-denied-page="/denied.html">		<intercept-url pattern="/login.html" access="IS_AUTHENTICATED_ANONYMOUSLY"/>		<intercept-url pattern="/index.html" access="IS_AUTHENTICATED_ANONYMOUSLY"/>		<intercept-url pattern="/m/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/>		<intercept-url pattern="/commons/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/>		<intercept-url pattern="/upload/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/>        <intercept-url pattern="/cms/**" access="ROLE_USER"/>       <!--  <intercept-url pattern="/adminIndex.html" access="ROLE_USER"/> -->        <intercept-url pattern="/pages/*.html" access="ROLE_USER"/>       <!--  logout-success-url="/login.html" -->        <logout logout-url="/j_spring_security_logout" invalidate-session="true"             delete-cookies="JSESSIONID" success-handler-ref="myLogoutSuccessHandler"/>                <custom-filter ref="corsFilter" after="PRE_AUTH_FILTER"/>		<custom-filter ref="myLoginFilter" position="FORM_LOGIN_FILTER" />		<custom-filter ref="mySecurityFilter" before="FILTER_SECURITY_INTERCEPTOR" />	</http>		<beans:bean id="corsFilter" class="com.threeti.danfoss.base.filter.SecurityCorsFilter" />		<beans:bean id="sas"		class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">		<beans:property name="maximumSessions" value="1"></beans:property>		<beans:property name="exceptionIfMaximumExceeded"			value="true"></beans:property>		<beans:constructor-arg name="sessionRegistry"			ref="sessionRegistry"></beans:constructor-arg>	</beans:bean>		<beans:bean id="sessionRegistry"		class="org.springframework.security.core.session.SessionRegistryImpl"></beans:bean>	<beans:bean id="myLoginFilter"		class="com.threeti.danfoss.base.filter.MyUsernamePassWordAuthenticationFilter">		<beans:property name="authenticationManager" ref="myAuthenticationManager"/>          <beans:property name="authenticationFailureHandler" ref="failureHandler"/>          <beans:property name="authenticationSuccessHandler" ref="successHandler"/>  		<beans:property name="sessionAuthenticationStrategy"			ref="sas"></beans:property>	</beans:bean>		      <beans:bean id="successHandler" class="com.threeti.danfoss.base.handler.MyAuthenticationSuccessHandler">          <beans:property name="defaultTargetUrl" value="/pages/menu.html#current/wind/surface/level/anim=off/overlay=misery_index/orthographic=39.08,42.42,294/loc=96.475,39.357" />      </beans:bean>         <beans:bean id="failureHandler" class="com.threeti.danfoss.base.handler.MySimpleUrlAuthenticationFailureHandler">          <beans:property name="defaultFailureUrl" value="/index.html"/>      </beans:bean>         <beans:bean id="myLogoutSuccessHandler" class="com.threeti.danfoss.base.handler.MyLogoutSuccessHandler">       	<beans:property name="defaultTargetUrl" value="/login.html"/>       	<!-- 下面的 是通過(guò)在url參數(shù)進(jìn)行跳轉(zhuǎn) -->       	<!-- <property name="targetUrlParameter" value="target-url"/>      	<property name="redirectStrategy" ref="safeRedirectStrategy"/> -->    </beans:bean>     <!-- 安全的RedirectStrategy，主要是判斷跳轉(zhuǎn)地址是否在白名單中    public class SafeRedirectStrategy implements RedirectStrategy -->    <!-- <beans:bean id="safeRedirectStrategy" class="com.snsxiu.job.web.security.SafeRedirectStrategy"/> -->    	<!-- 1.URL過(guò)濾器或方法攔截器：用來(lái)攔截URL或者方法資源對(duì)其進(jìn)行驗(yàn)證，其抽象基類為AbstractSecurityInterceptor 		2.資源權(quán)限獲取器：用來(lái)取得訪問(wèn)某個(gè)URL或者方法所需要的權(quán)限，接口為SecurityMetadataSource 3.訪問(wèn)決策器：用來(lái)決定用戶是否擁有訪問(wèn)權(quán)限的關(guān)鍵類，其接口為AccessDecisionManager 		調(diào)用順序?yàn)椋篈bstractSecurityInterceptor調(diào)用SecurityMetadataSource取得資源的所有可訪問(wèn)權(quán)限， 然后再調(diào)用AccessDecisionManager來(lái)實(shí)現(xiàn)決策，確定用戶是否有權(quán)限訪問(wèn)該資源。 -->	<!-- 自定義的filter, 必須包含authenticationManager, accessDecisionManager, securityMetadataSource三個(gè)屬性 -->	<beans:bean id="mySecurityFilter" class="com.threeti.danfoss.base.security.XaFilterSecurityInterceptor">		<beans:property name="authenticationManager" ref="myAuthenticationManager" />		<beans:property name="accessDecisionManager" ref="myAccessDecisionManager" />		<beans:property name="securityMetadataSource" ref="mySecurityMetadataSource" />	</beans:bean>	<!-- 取HTTP配置中的authenticationManager 設(shè)置alias別名 -->	<authentication-manager alias="myAuthenticationManager">		<authentication-provider user-service-ref="userDetailsManager">            <password-encoder hash="md5"/>		</authentication-provider>	</authentication-manager>		<!-- 用戶詳細(xì)信息管理：數(shù)據(jù)源、用戶緩存（通過(guò)數(shù)據(jù)庫(kù)管理用戶、角色、權(quán)限、資源） -->	<beans:bean id="userDetailsManager" class="com.threeti.danfoss.base.security.XaUserDetailsService">	</beans:bean>	<!-- 訪問(wèn)決策器，決定某個(gè)用戶具有的角色，是否有足夠的權(quán)限去訪問(wèn)某個(gè)資源。 -->	<beans:bean id="myAccessDecisionManager"		class="com.threeti.danfoss.base.security.XaAccessDecisionManagerService" />	<!-- 資源源數(shù)據(jù)定義，將所有的資源和權(quán)限對(duì)應(yīng)關(guān)系建立起來(lái)，即定義某一資源可以被哪些角色去訪問(wèn)。 -->	<beans:bean id="mySecurityMetadataSource" init-method="loadResourceDefine"		class="com.threeti.danfoss.base.security.XaSecurityMetadataSourceService">	</beans:bean>			<beans:bean id="authenticationEntryPoint"		class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">		<beans:property name="loginFormUrl" value="/login.html" />	</beans:bean></beans:beans>java 代碼
package com.threeti.danfoss.base.handler;import java.io.IOException;import javax.servlet.ServletException;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.security.core.Authentication;import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;import org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler;import com.threeti.danfoss.base.constant.XaConstant;import com.threeti.danfoss.base.entity.XaCmsUser;import com.threeti.danfoss.base.repository.XaCmsUserRepository;import com.threeti.danfoss.base.security.XaUserDetails;public class MyLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler   implements LogoutSuccessHandler{@Autowiredprivate XaCmsUserRepository xaCmsUserRepository;@Overridepublic void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)throws IOException, ServletException {XaUserDetails user = (XaUserDetails) authentication.getPrincipal();XaCmsUser u = xaCmsUserRepository.findByUserName(user.getUsername(),XaConstant.Status.valid);u.setOnline(0);xaCmsUserRepository.save(u);super.onLogoutSuccess(request, response, authentication);}}
還有另外一種方式：下面的就是復(fù)制前面的東西。沒有進(jìn)行測(cè)試，先記錄下來(lái)，有空進(jìn)行測(cè)試：
這里是前輩的文章地址：http://www.111cn.net/jsp/J2ME/60099.htm
spring security的form-login提供了default-target-url作為登錄成功后的跳轉(zhuǎn)地址，唯獨(dú)沒有允許傳遞一個(gè)redirectUrl參數(shù)來(lái)作為成功后的跳轉(zhuǎn)地址。同樣的logout標(biāo)簽提供了logout-success-url作為退出成功后的跳轉(zhuǎn)地址，也沒有提供允許傳遞redirectUrl參數(shù)來(lái)進(jìn)行跳轉(zhuǎn)。本來(lái)打算自己實(shí)現(xiàn)和AdminAuthSuccessHandler和LogoutSuccessHandler來(lái)接收redirectUrl參數(shù)進(jìn)行跳轉(zhuǎn)的，結(jié)果查看spring security的代碼無(wú)意間發(fā)現(xiàn)spring security居然提供了targetUrlParameter作為跳轉(zhuǎn)地址的參數(shù)，只是Security Namespace沒有相關(guān)的標(biāo)簽或?qū)傩浴Ｓ谑窃谧x完跳轉(zhuǎn)相關(guān)的代碼之后自己寫了以下配置。注：如果直接允許傳遞redirectUrl作為跳轉(zhuǎn)地址，會(huì)有一定的安全風(fēng)險(xiǎn)。在使用之前，確保redirectUrl可信。下面的這段配置有一定安全隱患。
 代碼如下
復(fù)制代碼
<sec:http auto-config="true">    <sec:intercept-url pattern="/admin/login" access="IS_AUTHENTICATED_ANONYMOUSLY"/>    <sec:form-login login-page="/admin/login" authentication-failure-handler-ref="adminAuthFailureHandler" authentication-success-handler-ref="adminAuthSuccessHandler"/>    <sec:logout success-handler-ref="adminLogoutSuccessHandler"/>    <sec:remember-me data-source-ref="jobDataSource"/>    <sec:session-management>        <sec:concurrency-control error-if-maximum-exceeded="true" max-sessions="1"/>    </sec:session-management></sec:http> <bean id="adminAuthFailureHandler" class="com.snsxiu.job.handler.AdminAuthFailureHandler">      <property name="authenticationFailureUrl" value="/admin/login?error=true"/></bean>   <bean id="adminAuthSuccessHandler" class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">    <property name="targetUrlParameter" value="target-url"/>    <property name="defaultTargetUrl" value="/admin/index"/></bean>   <bean id="adminLogoutSuccessHandler" class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler">    <property name="targetUrlParameter" value="target-url"/>    <property name="defaultTargetUrl" value="/admin/login"/></bean>
通過(guò)查看源碼我們發(fā)現(xiàn)，SimpleUrlLogoutSuccessHandler繼續(xù)了AbstractAuthenticationTargetUrlRequestHandler，同樣的SavedRequestAwareAuthenticationSuccessHandler也是繼承了AbstractAuthenticationTargetUrlRequestHandler，而在AbstractAuthenticationTargetUrlRequestHandler的handle方法里，我們發(fā)現(xiàn)它是通過(guò)determineTargetUrl()方法來(lái)決定Redirect地址的。
 代碼如下
復(fù)制代碼
public class SimpleUrlLogoutSuccessHandler extends AbstractAuthenticationTargetUrlRequestHandler        implements LogoutSuccessHandler {     public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)            throws IOException, ServletException {        super.handle(request, response, authentication);    } }
通過(guò)分析determineTargetUrl我們得出以下結(jié)論：①如果alwaysUseDefaultTargetUrl為true，則跳轉(zhuǎn)地址始終為defaultTargetUrl②如果targetUrlParameter不為null,則從request中targetUrlParameter指定的參數(shù)名獲取跳轉(zhuǎn)地址③如果useReferer為true，并且前兩步?jīng)]有獲取到跳轉(zhuǎn)地址，則從請(qǐng)求頭中的Referer獲取跳轉(zhuǎn)地址④如果以上幾步都為空，則使用設(shè)置的defaultTargetUrl作為跳轉(zhuǎn)地址⑤defaultTargetUrl的默認(rèn)值是"/" 在最終跳轉(zhuǎn)時(shí)，spring security使用一個(gè)RedirectStrategy策略來(lái)進(jìn)行跳轉(zhuǎn)，一般都是使用DefaultRedirectStrategy來(lái)進(jìn)行跳轉(zhuǎn)，你也可以實(shí)現(xiàn)自己的RedirectStrategy并配置在adminAuthSuccessHandler的bean定義中。 在剛開始的時(shí)候我們說(shuō)過(guò)“如果直接允許傳遞redirectUrl作為跳轉(zhuǎn)地址，會(huì)有一定的安全風(fēng)險(xiǎn)”。如果別人通過(guò)你的login或logout傳遞redirectUrl參數(shù)誤導(dǎo)用戶跳到了病毒木馬網(wǎng)站，那這肯定是你的安全做的不夠，為了安全我們，我們需要實(shí)現(xiàn)自己的SafeRedirectStrategy，如下所示，在跳轉(zhuǎn)之前對(duì)URL進(jìn)行了白名單校驗(yàn)。
 代碼如下
復(fù)制代碼
/** * 安全的RedirectStrategy，主要是判斷跳轉(zhuǎn)地址是否在白名單中 * @author guoweiwei gww0426@163.com * */public class SafeRedirectStrategy implements RedirectStrategy {     protected final Log logger = LogFactory.getLog(getClass());     private boolean contextRelative;     /**     * Redirects the response to the supplied URL.     * <p>     * If <tt>contextRelative</tt> is set, the redirect value will be the value after the request context path. Note     * that this will result in the loss of protocol information (HTTP or HTTPS), so will cause problems if a     * redirect is being performed to change to HTTPS, for example.     */    public void sendRedirect(HttpServletRequest request, HttpServletResponse response, String url) throws IOException {        String redirectUrl = calculateRedirectUrl(request.getContextPath(), url);                  try {            if(UrlUtils.isAbsoluteUrl(redirectUrl)){                        redirectUrl = UrlUtil.buildRedirectLink(redirectUrl, false);                    }        } catch (Exception e) {            throw new IOException("error redirect url", e);        }                  redirectUrl = response.encodeRedirectURL(redirectUrl);         if (logger.isDebugEnabled()) {            logger.debug("Redirecting to '" + redirectUrl + "'");        }         response.sendRedirect(redirectUrl);    }     private String calculateRedirectUrl(String contextPath, String url) {        if (!UrlUtils.isAbsoluteUrl(url)) {            if (contextRelative) {                return url;            } else {                return contextPath + url;            }        }         // Full URL, including http(s)://         if (!contextRelative) {            return url;        }         // Calculate the relative URL from the fully qualified URL, minus the scheme and base context.        url = url.substring(url.indexOf("://") + 3); // strip off scheme        url = url.substring(url.indexOf(contextPath) + contextPath.length());         if (url.length() > 1 && url.charAt(0) == '/') {            url = url.substring(1);        }         return url;    }     /**     * If <tt>true</tt>, causes any redirection URLs to be calculated minus the protocol     * and context path (defaults to <tt>false</tt>).     */    public void setContextRelative(boolean useRelativeContext) {        this.contextRelative = useRelativeContext;    } }
上面代碼中UrlUtil為自己實(shí)現(xiàn)的一個(gè)Url處理工具，buildRedirectLink會(huì)對(duì)url做白名單校驗(yàn)。完了別忘了在servlet.xml的bean配置中加入safeRedirectStrategy。如下所示：
 代碼如下
復(fù)制代碼
<bean id="adminAuthSuccessHandler" class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">    <property name="targetUrlParameter" value="target-url"/>    <property name="defaultTargetUrl" value="/admin/index"/>    <property name="redirectStrategy" ref="safeRedirectStrategy"/>  </bean>     <bean id="adminLogoutSuccessHandler" class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler">      <property name="targetUrlParameter" value="target-url"/>      <property name="defaultTargetUrl" value="/admin/login"/>      <property name="redirectStrategy" ref="safeRedirectStrategy"/>  </bean>     <bean id="safeRedirectStrategy" class="com.snsxiu.job.web.security.SafeRedirectStrategy"/>