shiro session 超時時間設置無效, 排查過程

Spring - shiro   

   shiro 設置session超時時間為2分鍾   

<bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
    <property name="globalSessionTimeout" value="120000"/>
    <property name="deleteInvalidSessions" value="true"/>
    <!-- <property name="sessionValidationSchedulerEnabled" value="true"/> -->
    <property name="sessionValidationScheduler" ref="sessionValidationScheduler"/>
    <property name="sessionDAO" ref="sessionDAO"/>
    <property name="sessionIdCookieEnabled" value="true"/>
    <property name="sessionIdCookie" ref="sessionIdCookie"/>
</bean>

 

web.xml

　　web配置文件設置超時時間2分鍾

<session-config>
   <session-timeout>2</session-timeout>
</session-config>


原因：

在CheckCodeController.java類中, 為了設置驗證碼的有效時間, 架構師給session設置了maxInactivevInterval最大有效時間, 這個設置直接覆蓋了shiro和web.xml中超時配置.
下面是生成驗證碼函數的代碼

private void generateGBCheckCode() throws Exception{
	int codeCount = 4;
		
	final int width = 30 * codeCount, height = 36;
	BufferedImage image = new BufferedImage(width, height,   
    	BufferedImage.TYPE_INT_RGB);
		
	final String sCheckCode = creatImageGB(image, codeCount);
	final HttpSession session = request.getSession();
	session.setMaxInactiveInterval(GENERATE_TIME);
	session.setAttribute(ManageConstants.GENERATE_CHECK_CODE_FLAG, sCheckCode);

	response.setHeader("Cache-Control","no-cache"); //HTTP 1.1
        response.setHeader("Pragma","no-cache"); //HTTP 1.0
        response.setDateHeader("Expires", -1); //prevents caching at the proxy server
        response.setContentType("image/png");
        ImageIO.write(image, "PNG", response.getOutputStream());
}