JavaWeb 如何设计用户多个浏览器登陆时只有最新的登陆的有效

Question

例如用户在A浏览器上登陆了，然后用手机打开B浏览器又登陆了，要让A浏览器上的用户退出（用户再次操作时提示登陆即可）
我的设计如下，这样设计有什么问题吗？因为有时候会报错

java.lang.IllegalStateException: getAttribute: Session already invalidated

我的代码：

    //登陆方法
    private void login(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException{
        //验证用户通过
        ....
        //判断当前用户是否已经登陆,如果已经登陆，清掉之前的登陆信息(上次登陆失效);
        if(isAlreadyLogin(user.getId(),request)){
            Map<String,HttpSession> sessionMap = (Map<String, HttpSession>)request.getServletContext().getAttribute("sessionMap");
            try {
                sessionMap.get(user.getId()).removeAttribute("userID");**//这句报错**
                sessionMap.get(user.getId()).removeAttribute("user");
            } catch (Exception e) {
                // TODO Java.lang.IllegalStateException: getAttribute: Session already invalidated
            }
        }
        //登陆成功 ,设置session 
        request.getSession(true).setAttribute("user", user);
        request.getSession(true).setAttribute("userID", user.getId());
        addSessionToMap(user.getId(), request);
        ....
    }
    
    //退出方法
    private void logOut(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException{
        String userId = (String)request.getSession().getAttribute("userID");
        removeSessionToMap(userId,request);
        request.getSession().removeAttribute("userID");
        request.getSession().removeAttribute("user");
        //返回信息
        ......
    }
    
    /**
     * 判断用户是否已经登录
     */
    private static boolean isAlreadyLogin(String userId,HttpServletRequest request){
        ServletContext application = request.getServletContext();
        Map<String,HttpSession> sessionMap = (Map<String,HttpSession>)application.getAttribute("sessionMap");
        if(sessionMap==null||sessionMap.get(userId)==null){
            return false;
        }
        return true;
    }

    private static void addSessionToMap(String userId,HttpServletRequest request){
        ServletContext application = request.getServletContext();
        Map<String,HttpSession> sessionMap = (Map<String,HttpSession>)application.getAttribute("sessionMap");
        if(sessionMap==null){
            sessionMap = new HashMap<String,HttpSession>();
        }
        sessionMap.put(userId, request.getSession());
        application.setAttribute("sessionMap", sessionMap);
    }
    
    private static void removeSessionToMap(String userId,HttpServletRequest request){
        ServletContext application = request.getServletContext();
        Map<String,HttpSession> sessionMap = (Map<String,HttpSession>)application.getAttribute("sessionMap");
        if(sessionMap==null){
            sessionMap = new HashMap<String,HttpSession>();
        }
        sessionMap.remove(userId);
        application.setAttribute("sessionMap", sessionMap);
    }

请大牛指教，谢了。

Answer 1

removeAttribute 方法说明

void removeAttribute(java.lang.String name)
Removes the object bound with the specified name from this session. If the session does not have an object bound with the specified name, this method does nothing.
After this method executes, and if the object implements HttpSessionBindingListener, the container calls HttpSessionBindingListener.valueUnbound. The container then notifies any HttpSessionAttributeListeners in the web application.

Parameters:
name - the name of the object to remove from this session
Throws:
IllegalStateException - if this method is called on an invalidated session

很显然session超时失效了，你在失效的session上调用方法就会出现你说的问题了。

Answer 2

可以redis来存储token.key为userId,value是token,之后只要每次检查userId和token是否可以对上就行了.

Answer 3

最后登录的会话保持有效token，判断请求所带token是否有效即可

Answer 4

你好！我同意HelloWorld的说法，你的session失效了，并不是说你的代码有问题。我感觉如果你登陆完浏览器1后立即登陆浏览器2，应该没有问题。