單機登錄實現思路（強制下線其他用戶）

主流的網站都是限制用戶單點登錄的，為什么要實現單點登錄？

1、避免單賬號多用戶操作占用大量數據庫連接，減輕webserver的壓力；

2、安全防范，強制下線非法用戶；

 

傳統的web服務器（如tomcat）對session有專門的管理，我們通過session來控制用戶的登錄生存周期。單點登錄原理如下：

1、將當前的session以Collections的形式緩存在application當中，用戶產生新的session，即清除用戶之前的session，保證collection里面的usersession都是唯一的；

2、實現效果每次用戶登錄都會擠掉之前用戶的登錄，每個用戶只能唯一在線；

 

        ServletContext application = request.getSession().getServletContext();
        Collection<HttpSession> sessions = null;
        if (application.getAttribute("usercount") == null) {
            sessions = new ArrayList<HttpSession>();
            application.setAttribute("usercount", sessions);
        } else {
            sessions = (Collection<HttpSession>) application
                    .getAttribute("usercount");
        }
        new LoginManager().login(sessions, session);
        SessionHandler.handleSession(session);

 

    public static boolean isLogin(HttpServletRequest request) {
        TuserEntity tuser = getUser(request);
        
        if(tuser!=null){
            Map<String, HttpSession> map = (Map<String, HttpSession>) request.getSession()
                                                        .getServletContext().getAttribute("sessionMap");
            if(map.get(tuser.getLogname())==null){
                request.getSession().invalidate();
                return false;
            }
        }
        return getUser(request) != null;
    }

 

LoginManager.java

public class LoginManager {

    public HttpSession login(Collection<HttpSession> sessions,
            HttpSession session) {
        ArrayList<HttpSession> sessionde = new ArrayList<HttpSession>();

        for (HttpSession s : sessions) {
            try {
                int historyuser = ((TuserEntity) s.getAttribute("user_session")).getId();
                int nowuser = ((TuserEntity) session.getAttribute("user_session"))
                .getId();
                if (historyuser == nowuser) {

                    sessions.remove(s); // 移除集合中的重復session元素

                    if(!s.equals(session)){
                        s.invalidate();// 廢棄之前登陸的session
                    }
                    break;
                }

            } catch (Exception e) {
                //e.printStackTrace();
                sessionde.add(s);
            } 

        }
        for (int i = 0; i < sessionde.size(); i++) {
            sessions.remove((HttpSession) sessionde.get(i));
        }
        sessions.add(session);
        return null;
    }
}

　　

 

新增和廢棄ServletContext里面的sessionMap的用戶session

    public static void handleSession(HttpSession session) {
        try {
            Map<String, HttpSession> sessionMap = (Map<String, HttpSession>) session.getServletContext().getAttribute("sessionMap");
            TuserEntity tuser = (TuserEntity) session.getAttribute(Keys.USER_SESSION_KEY);
            if(sessionMap.get(tuser.getLogname())!=null){
                sessionMap.remove(tuser.getLogname());
            }
            sessionMap.put(tuser.getLogname(), session);
        } catch (Exception e) {
            System.out.println("session error!");
        }
    }

 

 

    public void sessionDestroyed(HttpSessionEvent se) {
        Map<String, HttpSession> sessionMap = (Map<String, HttpSession>) se.getSession().getServletContext().getAttribute("sessionMap");
        TuserEntity tuser = (TuserEntity) se.getSession().getAttribute(Keys.USER_SESSION_KEY);
        if(tuser!=null){
            sessionMap.remove(tuser.getLogname());
        }
    }