浅谈基于Redis存储的SpringSession方案的实现原理

妖狐艹你老母 2022-09-04 09:52 262阅读 0赞

**目录**

SessionRepository接口

@EnableRedisHttpSession注解

RedisHttpSessionConfiguration配置类

SpringHttpSessionConfiguration配置类

SessionRepositoryFilter过滤器

存储Session的过程

获取Session的过程

--------------------

很早之前写过关于[分布式集群下session的管理实现][session]，其中有关于spring-session的实现方式，这种方式实际上是把httpsession交给spring管理

在写这篇文章前看了很多其他的博文,但是结合源码看下来都不太吻合，可能主要还是版本原因,例如RedisOperationsSessionRepository这个类在2.4.1版本已经标注了@deprecated被废弃了。本文章是基于Spring-session-data-redis的2.4.1版本源码分析流程的。

## SessionRepository接口 ##

在分析流程之前先了解下这个接口。  
看过源码后我的理解是spring-Session这个模块的作用其实是把servlert容器的httpSession拿到spring里来管理，而通常我们项目中使用的整合SpringSession一般指的是最终的实现方案。再说的简单点,就是我们使用的整合方案不管是redis也好还是MongoDB也还都是SpringSession的其中一种实现方案,而SessionRepository接口就是多种方案实现的扩展接口。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI5NTY5MTgz_size_16_color_FFFFFF_t_70][]

## @EnableRedisHttpSession注解 ##

使用基于Redis存储的SpringSession方案时，关键就是加上这个注解配置。这个注解沿用了spring系列开关注解的思路，通过@Import注解导入了SpringSession的核心配置类RedisHttpSessionConfiguration这个配置类。同时提供了基于注解参数maxInactiveIntervalInSeconds自定义session的过期时间。

@Retention(RetentionPolicy.RUNTIME)
    @Target({ElementType.TYPE})
    @Documented
    @Import({RedisHttpSessionConfiguration.class})
    @Configuration(
        proxyBeanMethods = false
    )
    public @interface EnableRedisHttpSession {
        int maxInactiveIntervalInSeconds() default 1800;
    
        String redisNamespace() default "spring:session";
    
        /** @deprecated */
        @Deprecated
        RedisFlushMode redisFlushMode() default RedisFlushMode.ON_SAVE;
    
        FlushMode flushMode() default FlushMode.ON_SAVE;
    
        String cleanupCron() default "0 * * * * *";
    
        SaveMode saveMode() default SaveMode.ON_SET_ATTRIBUTE;
    }

## RedisHttpSessionConfiguration配置类 ##

这个配置类是是spring-session-data-redis依赖包下的,也就是基于Redis存储实现SpringSession方案的核心配置类,所以要想使用基于redis的SpringSession就要使用@EnableRedisHttpSession注解使这个配置类生效。看到这个应该明确一个概念,这个配置类的各种配置是为了实现基于Redis实现SpringSession方案所需要的。

RedisHttpSessionConfiguration类继承自SpringHttpSessionConfiguration,关于SpringHttpSessionConfiguration这个配置类下面再说,先看当前这个配置类的内容。  
下面是部分代码片段,这个类主要配置了RedisIndexedSessionRepository这个Bean,这个就是上面提到的SessionRepository接口的实现类。类似的,如果是基于MongoDB实现的SpringSession方案对应的也会有一个实现SessionRepository接口的实现类。另外这个配置类中还配置了redis的RedisConnectionFactory。

public class RedisHttpSessionConfiguration extends SpringHttpSessionConfiguration implements BeanClassLoaderAware, EmbeddedValueResolverAware, ImportAware {
        static final String DEFAULT_CLEANUP_CRON = "0 * * * * *";
        private Integer maxInactiveIntervalInSeconds = 1800;
        private String redisNamespace = "spring:session";
        private FlushMode flushMode;
        private SaveMode saveMode;
        private String cleanupCron;
        private ConfigureRedisAction configureRedisAction;
        private RedisConnectionFactory redisConnectionFactory;
        private IndexResolver<Session> indexResolver;
        private RedisSerializer<Object> defaultRedisSerializer;
        private ApplicationEventPublisher applicationEventPublisher;
        private Executor redisTaskExecutor;
        private Executor redisSubscriptionExecutor;
        private List<SessionRepositoryCustomizer<RedisIndexedSessionRepository>> sessionRepositoryCustomizers;
        private ClassLoader classLoader;
        private StringValueResolver embeddedValueResolver;
    
        public RedisHttpSessionConfiguration() {
            this.flushMode = FlushMode.ON_SAVE;
            this.saveMode = SaveMode.ON_SET_ATTRIBUTE;
            this.cleanupCron = "0 * * * * *";
            this.configureRedisAction = new ConfigureNotifyKeyspaceEventsAction();
        }
    
    	//创建基于Redis实现SpringSession方案的SessionRepository接口的实现类
        @Bean
        public RedisIndexedSessionRepository sessionRepository() {
            RedisTemplate<Object, Object> redisTemplate = this.createRedisTemplate();
            RedisIndexedSessionRepository sessionRepository = new RedisIndexedSessionRepository(redisTemplate);
            sessionRepository.setApplicationEventPublisher(this.applicationEventPublisher);
            if (this.indexResolver != null) {
                sessionRepository.setIndexResolver(this.indexResolver);
            }
    
            if (this.defaultRedisSerializer != null) {
                sessionRepository.setDefaultSerializer(this.defaultRedisSerializer);
            }
    
            sessionRepository.setDefaultMaxInactiveInterval(this.maxInactiveIntervalInSeconds);
            if (StringUtils.hasText(this.redisNamespace)) {
                sessionRepository.setRedisKeyNamespace(this.redisNamespace);
            }
    
            sessionRepository.setFlushMode(this.flushMode);
            sessionRepository.setSaveMode(this.saveMode);
            int database = this.resolveDatabase();
            sessionRepository.setDatabase(database);
            this.sessionRepositoryCustomizers.forEach((sessionRepositoryCustomizer) -> {
                sessionRepositoryCustomizer.customize(sessionRepository);
            });
            return sessionRepository;
        }
    
        @Bean
        public RedisMessageListenerContainer springSessionRedisMessageListenerContainer(RedisIndexedSessionRepository sessionRepository) {
            RedisMessageListenerContainer container = new RedisMessageListenerContainer();
            container.setConnectionFactory(this.redisConnectionFactory);
            if (this.redisTaskExecutor != null) {
                container.setTaskExecutor(this.redisTaskExecutor);
            }
    
            if (this.redisSubscriptionExecutor != null) {
                container.setSubscriptionExecutor(this.redisSubscriptionExecutor);
            }
    
            container.addMessageListener(sessionRepository, Arrays.asList(new ChannelTopic(sessionRepository.getSessionDeletedChannel()), new ChannelTopic(sessionRepository.getSessionExpiredChannel())));
            container.addMessageListener(sessionRepository, Collections.singletonList(new PatternTopic(sessionRepository.getSessionCreatedChannelPrefix() + "*")));
            return container;
        }
    	//注入Redis的RedisConnectionFactory
        @Autowired
        public void setRedisConnectionFactory(@SpringSessionRedisConnectionFactory ObjectProvider<RedisConnectionFactory> springSessionRedisConnectionFactory, ObjectProvider<RedisConnectionFactory> redisConnectionFactory) {
            RedisConnectionFactory redisConnectionFactoryToUse = (RedisConnectionFactory)springSessionRedisConnectionFactory.getIfAvailable();
            if (redisConnectionFactoryToUse == null) {
                redisConnectionFactoryToUse = (RedisConnectionFactory)redisConnectionFactory.getObject();
            }
    
            this.redisConnectionFactory = redisConnectionFactoryToUse;
        }
    
        private RedisTemplate<Object, Object> createRedisTemplate() {
            RedisTemplate<Object, Object> redisTemplate = new RedisTemplate();
            redisTemplate.setKeySerializer(new StringRedisSerializer());
            redisTemplate.setHashKeySerializer(new StringRedisSerializer());
            if (this.defaultRedisSerializer != null) {
                redisTemplate.setDefaultSerializer(this.defaultRedisSerializer);
            }
    
            redisTemplate.setConnectionFactory(this.redisConnectionFactory);
            redisTemplate.setBeanClassLoader(this.classLoader);
            redisTemplate.afterPropertiesSet();
            return redisTemplate;
        }
    }

## SpringHttpSessionConfiguration配置类 ##

上面说到RedisHttpSessionConfiguration配置类继承了SpringHttpSessionConfiguration配置类,这个类是spring-session-core这个依赖包下面的。看到这个觉得突然明白了点什么,也就是说这个配置是SpringSession的基础配置类,redis存储实现方案的配置类继承了这个配置类。  
下面是部分代码片段,这里配置了一个Filter,即SessionRepositoryFilter这个Bean。重点在这，这个SessionRepositoryFilter是实现把servlert容器的httpSession拿到spring里来管理的关键。所以基于Redis存储的实现肯定也需要这个配置,于是就对这个配置类做了继承。

public class SpringHttpSessionConfiguration implements ApplicationContextAware {
        private final Log logger = LogFactory.getLog(this.getClass());
        private CookieHttpSessionIdResolver defaultHttpSessionIdResolver = new CookieHttpSessionIdResolver();
        private boolean usesSpringSessionRememberMeServices;
        private ServletContext servletContext;
        private CookieSerializer cookieSerializer;
        private HttpSessionIdResolver httpSessionIdResolver;
        private List<HttpSessionListener> httpSessionListeners;
    
        public SpringHttpSessionConfiguration() {
            this.httpSessionIdResolver = this.defaultHttpSessionIdResolver;
            this.httpSessionListeners = new ArrayList();
        }
    
        @PostConstruct
        public void init() {
            CookieSerializer cookieSerializer = this.cookieSerializer != null ? this.cookieSerializer : this.createDefaultCookieSerializer();
            this.defaultHttpSessionIdResolver.setCookieSerializer(cookieSerializer);
        }
    
        @Bean
        public SessionEventHttpSessionListenerAdapter sessionEventHttpSessionListenerAdapter() {
            return new SessionEventHttpSessionListenerAdapter(this.httpSessionListeners);
        }
    	//配置SessionRepositoryFilter这个Bean
        @Bean
        public <S extends Session> SessionRepositoryFilter<? extends Session> springSessionRepositoryFilter(SessionRepository<S> sessionRepository) {
            SessionRepositoryFilter<S> sessionRepositoryFilter = new SessionRepositoryFilter(sessionRepository);
            sessionRepositoryFilter.setHttpSessionIdResolver(this.httpSessionIdResolver);
            return sessionRepositoryFilter;
        }
    
        public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
            if (ClassUtils.isPresent("org.springframework.security.web.authentication.RememberMeServices", (ClassLoader)null)) {
                this.usesSpringSessionRememberMeServices = !ObjectUtils.isEmpty(applicationContext.getBeanNamesForType(SpringSessionRememberMeServices.class));
            }
        }
    	@Autowired(required = false)
        public void setServletContext(ServletContext servletContext) {
            this.servletContext = servletContext;
        }
    	@Autowired(required = false)
        public void setCookieSerializer(CookieSerializer cookieSerializer) {
            this.cookieSerializer = cookieSerializer;
        }
        @Autowired(required = false)
        public void setHttpSessionIdResolver(HttpSessionIdResolver httpSessionIdResolver) {
            this.httpSessionIdResolver = httpSessionIdResolver;
        }
    	@Autowired(required = false)
        public void setHttpSessionListeners(List<HttpSessionListener> listeners) {
            this.httpSessionListeners = listeners;
        }
    }

## SessionRepositoryFilter过滤器 ##

SessionRepositoryFilter继承自OncePerRequestFilter,关于OncePerRequestFilter这里就不过多赘述了,SessionRepositoryFilter重写了父类的doFilterInternal方法，doFilterInternal方法就相当于普通Filter的doFilter方法。

在Spring-session流程中,通过SessionRepositoryFilter过滤器进行拦截，然后通过其继承了HttpServletRequestWrapper的SessionRepositoryRequestWrapper这个内部类进行Session的管理。

### 存储Session的过程 ###

通过doFilterInternal方法可以看到,SessionRepositoryFilter每次调用完毕后都会调用commitSession()方法。 当前的Session不为空的情况下，保存当前的Session。保存session后,会判断当前的SessionId是否与请求的中的Cookie中SessionId一致，若不一致的情况下会调用当前Filter中HttpSessionIdResolver接口的CookieHttpSessionIdResolver这个实例的setSessionId()方法,最终会把SessionId写到Cookie中。

protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    	request.setAttribute(SESSION_REPOSITORY_ATTR, this.sessionRepository);
    	SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper wrappedRequest = new SessionRepositoryFilter.SessionRepositoryRequestWrapper(request, response);
    	SessionRepositoryFilter.SessionRepositoryResponseWrapper wrappedResponse = new SessionRepositoryFilter.SessionRepositoryResponseWrapper(wrappedRequest, response);
    	try {
    		filterChain.doFilter(wrappedRequest, wrappedResponse);
    	} finally {
    		wrappedRequest.commitSession();
    	}
    
    }
    //SessionRepositoryRequestWrapper#commitSession()方法
    private void commitSession() {
    	SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper.HttpSessionWrapper wrappedSession = this.getCurrentSession();
    	if (wrappedSession == null) {
    		if (this.isInvalidateClientSession()) {
    			SessionRepositoryFilter.this.httpSessionIdResolver.expireSession(this, this.response);
    		}
    	} else {
    		S session = wrappedSession.getSession();
    		this.clearRequestedSessionCache();
    		将Session存放到Redis中存储
    		SessionRepositoryFilter.this.sessionRepository.save(session);
    		String sessionId = session.getId();
    		if (!this.isRequestedSessionIdValid() || !sessionId.equals(this.getRequestedSessionId())) {
    			SessionRepositoryFilter.this.httpSessionIdResolver.setSessionId(this, this.response, sessionId);
    		}
    	}
    
    }
    
    //CookieHttpSessionIdResolver#setSessionId()方法
    public void setSessionId(HttpServletRequest request, HttpServletResponse response, String sessionId) {
    	if (!sessionId.equals(request.getAttribute(WRITTEN_SESSION_ID_ATTR))) {
    		request.setAttribute(WRITTEN_SESSION_ID_ATTR, sessionId);
    		this.cookieSerializer.writeCookieValue(new CookieValue(request, response, sessionId));
    	}
    }

### 获取Session的过程 ###

SessionRepositoryFilter中通过调用内部类SessionRepositoryRequestWrapper的getSession(boolean create)方法获取session。  
获取Session的时候，先从请求中获取Session，Session不为空的情况下直接返回Session，若当前的Session为空的情况下，从Cookie中获取SessionId，判断SessionId不为空，再从Redis中获取Session，若从Redis中获取到的Session不为空将Session存放到请求中,再返回Session，如果从Redis中获取的Session为空，再创建新的Session并且添加到请求中，后返回Session。

public SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper.HttpSessionWrapper getSession(boolean create) {
    	SessionRepositoryFilter<S>.SessionRepositoryRequestWrapper.HttpSessionWrapper currentSession = this.getCurrentSession();
    	if (currentSession != null) {
    		return currentSession;
    	} else {
    		S requestedSession = this.getRequestedSession();
    		if (requestedSession != null) {
    			if (this.getAttribute(SessionRepositoryFilter.INVALID_SESSION_ID_ATTR) == null) {
    				requestedSession.setLastAccessedTime(Instant.now());
    				this.requestedSessionIdValid = true;
    				currentSession = new SessionRepositoryFilter.SessionRepositoryRequestWrapper.HttpSessionWrapper(requestedSession, this.getServletContext());
    				currentSession.markNotNew();
    				this.setCurrentSession(currentSession);
    				return currentSession;
    			}
    		} else {
    			if (SessionRepositoryFilter.SESSION_LOGGER.isDebugEnabled()) {
    				SessionRepositoryFilter.SESSION_LOGGER.debug("No session found by id: Caching result for getSession(false) for this HttpServletRequest.");
    			}
    
    			this.setAttribute(SessionRepositoryFilter.INVALID_SESSION_ID_ATTR, "true");
    		}
    
    		if (!create) {
    			return null;
    		} else {
    			if (SessionRepositoryFilter.SESSION_LOGGER.isDebugEnabled()) {
    				SessionRepositoryFilter.SESSION_LOGGER.debug("A new session was created. To help you troubleshoot where the session was created we provided a StackTrace (this is not an error). You can prevent this from appearing by disabling DEBUG logging for " + SessionRepositoryFilter.SESSION_LOGGER_NAME, new RuntimeException("For debugging purposes only (not an error)"));
    			}
    
    			S session = SessionRepositoryFilter.this.sessionRepository.createSession();
    			session.setLastAccessedTime(Instant.now());
    			currentSession = new SessionRepositoryFilter.SessionRepositoryRequestWrapper.HttpSessionWrapper(session, this.getServletContext());
    			this.setCurrentSession(currentSession);
    			return currentSession;
    		}
    	}
    }

[session]: https://fengkay.blog.csdn.net/article/details/103811019
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI5NTY5MTgz_size_16_color_FFFFFF_t_70]: /images/20220829/a2745e0ce233475c8c83c952a47d92e8.png