\u5728 JWT\u3001OAuth2\u3001Token \u98ce\u9761\u7684\u4eca\u5929，\u4f60\u53ef\u80fd\u4f1a\u95ee：<\/p>\n
\u201c\u73b0\u5728\u8fd8\u6709\u4eba\u7528 Session \u5417？\u201d<\/p>\n
\u7b54\u6848\u662f：\u6709！\u800c\u4e14\u5f88\u591a！<\/p>\n
Session \u662f\u7406\u89e3 Web \u8ba4\u8bc1\u673a\u5236\u7684\u57fa\u77f3\u3002\u638c\u63e1\u5b83，\u4f60\u624d\u80fd\u771f\u6b63\u7406\u89e3\u201c\u767b\u5f55\u201d\u80cc\u540e\u7684\u539f\u7406\u3002<\/p>\n
\u672c\u6587\u5c06\u5e26\u4f60：
\n\u2705 \u6df1\u5165 Session \u5de5\u4f5c\u539f\u7406
\n\u2705 \u624b\u52a8\u5b9e\u73b0\u5b8c\u6574\u767b\u5f55\/\u767b\u51fa\u6d41\u7a0b
\n\u2705 \u5728 Spring Boot \u4e2d\u5b89\u5168\u4f7f\u7528 Session
\n\u2705 \u907f\u5f00\u5e38\u89c1\u5b89\u5168\u9677\u9631<\/p>\n
+—————-+ +——————+
\n | \u6d4f\u89c8\u5668 | | \u670d\u52a1\u5668 |
\n +—————-+ +——————+
\n | |
\n1. \u63d0\u4ea4\u7528\u6237\u540d\u5bc6\u7801 | POST \/login |
\n |————————>|
\n | |
\n2. \u9a8c\u8bc1\u6210\u529f | \u521b\u5efa Session |
\n | \u5b58\u50a8\u7528\u6237\u4fe1\u606f |
\n | Set-Cookie: JSESSIONID=abc123
\n |<————————|
\n | |
\n3. \u540e\u7eed\u8bf7\u6c42 | Cookie: JSESSIONID=abc123
\n |————————>|
\n | \u670d\u52a1\u5668\u6839\u636e ID \u627e\u5230 Session
\n | \u786e\u8ba4\u7528\u6237\u5df2\u767b\u5f55 |
\n | |
\n4. \u70b9\u51fb\u9000\u51fa | GET \/logout |
\n |————————>|
\n | \u5220\u9664 Session |
\n | Clear Cookie |
\n |<————————|<\/p>\n
🔑\u00a0\u6838\u5fc3\u673a\u5236：<\/p>\n
<dependency>
\n <groupId>org.springframework.boot<\/groupId>
\n <artifactId>spring-boot-starter-web<\/artifactId>
\n<\/dependency>
\n<!– \u5185\u5d4c Tomcat \u81ea\u5e26 Session \u652f\u6301 –><\/p>\n
💡 Spring Boot \u9ed8\u8ba4\u4f7f\u7528\u00a0\u5185\u5b58\u5b58\u50a8 Session（\u91cd\u542f\u4e22\u5931），\u751f\u4ea7\u73af\u5883\u53ef\u96c6\u6210 Redis（\u89c1\u540e\u6587）\u3002<\/p>\n
public class User {
\n private String username;
\n private String password; \/\/ \u5b9e\u9645\u5e94\u5b58 BCrypt \u52a0\u5bc6\u540e\u7684\u503c
\n \/\/ getter\/setter…
\n}<\/p>\n
@Component
\npublic class UserDatabase {
\n private static final Map<String, User> users = new HashMap<>();<\/p>\n
static {
\n \/\/ \u6a21\u62df\u7528\u6237：admin \/ 123456
\n users.put("admin", new User("admin", "123456"));
\n }<\/p>\n
public User findByUsername(String username) {
\n return users.get(username);
\n }
\n}<\/p>\n
@Controller
\npublic class LoginController {<\/p>\n
@Autowired
\n private UserDatabase userDatabase;<\/p>\n
\/\/ \u8df3\u8f6c\u5230\u767b\u5f55\u9875
\n @GetMapping("\/login")
\n public String loginPage() {
\n return "login"; \/\/ \u8fd4\u56de templates\/login.html
\n }<\/p>\n
\/\/ \u5904\u7406\u767b\u5f55\u8bf7\u6c42
\n @PostMapping("\/login")
\n public String login(@RequestParam String username,
\n @RequestParam String password,
\n HttpSession session,
\n RedirectAttributes redirectAttributes) {<\/p>\n
\/\/ 1. \u6821\u9a8c\u53c2\u6570
\n if (username == null || username.trim().isEmpty()) {
\n redirectAttributes.addFlashAttribute("error", "\u7528\u6237\u540d\u4e0d\u80fd\u4e3a\u7a7a");
\n return "redirect:\/login";
\n }<\/p>\n
\/\/ 2. \u67e5\u8be2\u7528\u6237
\n User user = userDatabase.findByUsername(username);
\n if (user == null || !user.getPassword().equals(password)) {
\n redirectAttributes.addFlashAttribute("error", "\u7528\u6237\u540d\u6216\u5bc6\u7801\u9519\u8bef");
\n return "redirect:\/login";
\n }<\/p>\n
\/\/ 3. \u767b\u5f55\u6210\u529f：\u5c06\u7528\u6237\u4fe1\u606f\u5b58\u5165 Session
\n session.setAttribute("currentUser", user.getUsername());
\n session.setMaxInactiveInterval(30 * 60); \/\/ 30\u5206\u949f\u65e0\u64cd\u4f5c\u81ea\u52a8\u8fc7\u671f<\/p>\n
return "redirect:\/home";
\n }<\/p>\n
\/\/ \u4e3b\u9875（\u9700\u767b\u5f55）
\n @GetMapping("\/home")
\n public String home(HttpSession session, Model model) {
\n String currentUser = (String) session.getAttribute("currentUser");
\n if (currentUser == null) {
\n return "redirect:\/login";
\n }
\n model.addAttribute("user", currentUser);
\n return "home";
\n }<\/p>\n
\/\/ \u9000\u51fa\u767b\u5f55
\n @GetMapping("\/logout")
\n public String logout(HttpSession session) {
\n session.invalidate(); \/\/ \u9500\u6bc1\u6574\u4e2a Session
\n return "redirect:\/login";
\n }
\n}<\/p>\n
templates\/login.html<\/p>\n
<!DOCTYPE html>
\n<html xmlns:th="http:\/\/www.thymeleaf.org">
\n<head><title>\u767b\u5f55<\/title><\/head>
\n<body>
\n <h2>\u7528\u6237\u767b\u5f55<\/h2>
\n <div th:if="${error}" style="color:red;" th:text="${error}"><\/div><\/p>\n
<form method="post" action="\/login">
\n \u7528\u6237\u540d: <input type="text" name="username" required><br><br>
\n \u5bc6\u7801: <input type="password" name="password" required><br><br>
\n <button type="submit">\u767b\u5f55<\/button>
\n <\/form>
\n<\/body>
\n<\/html><\/p>\n
templates\/home.html<\/p>\n
<!DOCTYPE html>
\n<html>
\n<head><title>\u4e3b\u9875<\/title><\/head>
\n<body>
\n <h2>\u6b22\u8fce，<span th:text="${user}"><\/span>！<\/h2>
\n <a href="\/logout">\u9000\u51fa\u767b\u5f55<\/a>
\n<\/body>
\n<\/html><\/p>\n
\u793a\u4f8b：<\/p>\n
session.setAttribute("userId", 1001); \/\/ \u597d
\nsession.setAttribute("user", fullUserObject); \/\/ \u4e0d\u63a8\u8350<\/p>\n
\u65b9\u5f0f\u4e00：\u6bcf\u4e2a Controller \u624b\u52a8\u68c0\u67e5<\/p>\n
@GetMapping("\/profile")
\npublic String profile(HttpSession session) {
\n if (session.getAttribute("currentUser") == null) {
\n return "redirect:\/login";
\n }
\n \/\/ …
\n}<\/p>\n
\u65b9\u5f0f\u4e8c：\u4f7f\u7528\u62e6\u622a\u5668（\u63a8\u8350）<\/p>\n
@Component
\npublic class LoginInterceptor implements HandlerInterceptor {
\n @Override
\n public boolean preHandle(HttpServletRequest request,
\n HttpServletResponse response,
\n Object handler) throws Exception {
\n HttpSession session = request.getSession(false);
\n if (session == null || session.getAttribute("currentUser") == null) {
\n response.sendRedirect("\/login");
\n return false;
\n }
\n return true;
\n }
\n}<\/p>\n
@Configuration
\npublic class WebConfig implements WebMvcConfigurer {
\n @Override
\n public void addInterceptors(InterceptorRegistry registry) {
\n registry.addInterceptor(new LoginInterceptor())
\n .addPathPatterns("\/home", "\/profile", "\/settings\/**")
\n .excludePathPatterns("\/login", "\/css\/**", "\/js\/**");
\n }
\n}<\/p>\n
\/\/ \u5b58\u50a8\u65f6\u52a0\u5bc6
\nString hashedPassword = BCrypt.hashpw(rawPassword, BCrypt.gensalt());
\n\/\/ \u9a8c\u8bc1\u65f6\u6bd4\u5bf9
\nif (BCrypt.checkpw(inputPassword, storedHash)) { … }\n<\/li>\n<\/ul>\n
# application.yml
\nserver:
\n servlet:
\n session:
\n cookie:
\n http-only: true # \u7981\u6b62 JS \u8bbf\u95ee Cookie
\n secure: false # \u751f\u4ea7\u73af\u5883 HTTPS \u65f6\u8bbe\u4e3a true
\n same-site: strict # \u9632 CSRF（\u90e8\u5206\u6d4f\u89c8\u5668\u652f\u6301）\n<\/li>\n<\/ul>\n
\/\/ \u5728 login \u6210\u529f\u540e
\nsession = request.getSession(); \/\/ \u83b7\u53d6\u5f53\u524d session
\nsession.invalidate(); \/\/ \u9500\u6bc1\u65e7 session
\nsession = request.getSession(true); \/\/ \u521b\u5efa\u65b0 session
\nsession.setAttribute("currentUser", username);\n<\/li>\n<\/ul>\n
\u2705 Spring Security \u9ed8\u8ba4\u5df2\u5904\u7406\u6b64\u95ee\u9898，\u4f46\u624b\u5199\u767b\u5f55\u9700\u6ce8\u610f！<\/p>\n
\u5355\u673a Session \u5b58\u5185\u5b58\u6ca1\u95ee\u9898，\u4f46\u591a\u5b9e\u4f8b\u90e8\u7f72\u65f6\u4f1a\u4e22\u5931\u4f1a\u8bdd！<\/p>\n
<dependency>
\n <groupId>org.springframework.session<\/groupId>
\n <artifactId>spring-session-data-redis<\/artifactId>
\n<\/dependency><\/p>\n
@EnableRedisHttpSession(maxInactiveIntervalInSeconds = 1800)
\npublic class SessionConfig {}<\/p>\n
🎉 \u6b64\u65f6\u6240\u6709\u5b9e\u4f8b\u5171\u4eab Session，\u65e0\u7f1d\u652f\u6301\u6c34\u5e73\u6269\u5c55！<\/p>\n
| \u72b6\u6001<\/td>\n | \u6709\u72b6\u6001（\u670d\u52a1\u7aef\u5b58\u50a8）<\/td>\n | \u65e0\u72b6\u6001<\/td>\n<\/tr>\n |
| \u8de8\u57df<\/td>\n | \u56f0\u96be（Cookie \u9650\u5236）<\/td>\n | \u5bb9\u6613（Header \u4f20\u9012）<\/td>\n<\/tr>\n |
| \u5b89\u5168\u6027<\/td>\n | \u9ad8（\u53ef\u4e3b\u52a8\u9500\u6bc1）<\/td>\n | \u4f9d\u8d56\u7b7e\u540d，\u65e0\u6cd5\u4e3b\u52a8\u5931\u6548<\/td>\n<\/tr>\n |
| \u9002\u7528\u573a\u666f<\/td>\n | \u4f20\u7edf Web \u5e94\u7528<\/td>\n | \u524d\u540e\u7aef\u5206\u79bb\u3001\u79fb\u52a8\u7aef<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n 📌\u00a0\u5efa\u8bae：<\/p>\n
|