序

本文主要介绍下spring boot中对session timeout参数值的设置过程。

ServerProperties

spring-boot-autoconfigure-1.5.8.RELEASE-sources.jar!/org/springframework/boot/autoconfigure/web/ServerProperties.java

@Overridepublic void customize(ConfigurableEmbeddedServletContainer container) {if (getPort() != null) {container.setPort(getPort());}if (getAddress() != null) {container.setAddress(getAddress());}if (getContextPath() != null) {container.setContextPath(getContextPath());}if (getDisplayName() != null) {container.setDisplayName(getDisplayName());}if (getSession().getTimeout() != null) {container.setSessionTimeout(getSession().getTimeout());}//......}

对应的配置如下

server.session.timeout=120

需要注意单位是秒

TomcatEmbeddedServletContainerFactory

spring-boot-1.5.8.RELEASE-sources.jar!/org/springframework/boot/context/embedded/tomcat/TomcatEmbeddedServletContainerFactory.java

protected void configureContext(Context context,ServletContextInitializer[] initializers) {TomcatStarter starter = new TomcatStarter(initializers);if (context instanceof TomcatEmbeddedContext) {// Should be true((TomcatEmbeddedContext) context).setStarter(starter);}context.addServletContainerInitializer(starter, NO_CLASSES);for (LifecycleListener lifecycleListener : this.contextLifecycleListeners) {context.addLifecycleListener(lifecycleListener);}for (Valve valve : this.contextValves) {context.getPipeline().addValve(valve);}for (ErrorPage errorPage : getErrorPages()) {new TomcatErrorPage(errorPage).addToContext(context);}for (MimeMappings.Mapping mapping : getMimeMappings()) {context.addMimeMapping(mapping.getExtension(), mapping.getMimeType());}configureSession(context);for (TomcatContextCustomizer customizer : this.tomcatContextCustomizers) {customizer.customize(context);}}
private void configureSession(Context context) {long sessionTimeout = getSessionTimeoutInMinutes();context.setSessionTimeout((int) sessionTimeout);if (isPersistSession()) {Manager manager = context.getManager();if (manager == null) {manager = new StandardManager();context.setManager(manager);}configurePersistSession(manager);}else {context.addLifecycleListener(new DisablePersistSessionListener());}}
private long getSessionTimeoutInMinutes() {long sessionTimeout = getSessionTimeout();if (sessionTimeout > 0) {sessionTimeout = Math.max(TimeUnit.SECONDS.toMinutes(sessionTimeout), 1L);}return sessionTimeout;}

这里要注意一下，它内部转成分钟，然后设置给tomcat原生的StandardContext

可以从源码看到，如果设置小于60秒的话，则会默认取1分钟

StandardContext

tomcat-embed-core-8.5.23-sources.jar!/org/apache/catalina/core/StandardContext.java

@Overridepublic void setSessionTimeout(int timeout) {int oldSessionTimeout = this.sessionTimeout;/** SRV.13.4 ("Deployment Descriptor"):* If the timeout is 0 or less, the container ensures the default* behaviour of sessions is never to time out.*/this.sessionTimeout = (timeout == 0) ? -1 : timeout;support.firePropertyChange("sessionTimeout",oldSessionTimeout,this.sessionTimeout);}

这一步就是设置给原生的tomcat的StandardContext

session失效的计算

tomcat-embed-core-8.5.23-sources.jar!/org/apache/catalina/session/StandardSession.java

/*** Return the <code>isValid</code> flag for this session.*/@Overridepublic boolean isValid() {if (!this.isValid) {return false;}if (this.expiring) {return true;}if (ACTIVITY_CHECK && accessCount.get() > 0) {return true;}if (maxInactiveInterval > 0) {int timeIdle = (int) (getIdleTimeInternal() / 1000L);if (timeIdle >= maxInactiveInterval) {expire(true);}}return this.isValid;}

这里会去计算timeIdle，然后通过timeIdle的值跟设定的session timeout比较，超出则设置session失效

getIdleTimeInternal

   /*** Return the idle time from last client access time without invalidation check* @see #getIdleTime()*/@Overridepublic long getIdleTimeInternal() {long timeNow = System.currentTimeMillis();long timeIdle;if (LAST_ACCESS_AT_START) {timeIdle = timeNow - lastAccessedTime;} else {timeIdle = timeNow - thisAccessedTime;}return timeIdle;}

维护了两个变量，一个是lastAccessedTime，一个是thisAccessedTime

这个是在这个方法中更新

   /*** End the access.*/@Overridepublic void endAccess() {isNew = false;/*** The servlet spec mandates to ignore request handling time* in lastAccessedTime.*/if (LAST_ACCESS_AT_START) {this.lastAccessedTime = this.thisAccessedTime;this.thisAccessedTime = System.currentTimeMillis();} else {this.thisAccessedTime = System.currentTimeMillis();this.lastAccessedTime = this.thisAccessedTime;}if (ACTIVITY_CHECK) {accessCount.decrementAndGet();}}

正常请求更新

Http11Processor

tomcat-embed-core-8.5.23-sources.jar!/org/apache/coyote/http11/Http11Processor.java

    @Overridepublic SocketState service(SocketWrapperBase<?> socketWrapper)throws IOException {//......while (!getErrorState().isError() && keepAlive && !isAsync() && upgradeToken == null &&sendfileState == SendfileState.DONE && !endpoint.isPaused()) {// ......// Process the request in the adapterif (!getErrorState().isError()) {try {rp.setStage(org.apache.coyote.Constants.STAGE_SERVICE);getAdapter().service(request, response);// Handle when the response was committed before a serious// error occurred.  Throwing a ServletException should both// set the status to 500 and set the errorException.// If we fail here, then the response is likely already// committed, so we can't try and set headers.if(keepAlive && !getErrorState().isError() && !isAsync() &&statusDropsConnection(response.getStatus())) {setErrorState(ErrorState.CLOSE_CLEAN, null);}} catch (InterruptedIOException e) {setErrorState(ErrorState.CLOSE_CONNECTION_NOW, e);} catch (HeadersTooLargeException e) {log.error(sm.getString("http11processor.request.process"), e);// The response should not have been committed but check it// anyway to be safeif (response.isCommitted()) {setErrorState(ErrorState.CLOSE_NOW, e);} else {response.reset();response.setStatus(500);setErrorState(ErrorState.CLOSE_CLEAN, e);response.setHeader("Connection", "close"); // TODO: Remove}} catch (Throwable t) {ExceptionUtils.handleThrowable(t);log.error(sm.getString("http11processor.request.process"), t);// 500 - Internal Server Errorresponse.setStatus(500);setErrorState(ErrorState.CLOSE_CLEAN, t);getAdapter().log(request, response, 0);}}// Finish the handling of the requestrp.setStage(org.apache.coyote.Constants.STAGE_ENDINPUT);if (!isAsync()) {// If this is an async request then the request ends when it has// been completed. The AsyncContext is responsible for calling// endRequest() in that case.endRequest();}//......}//......}

这里的service方法在getErrorState().isError()为false的时候，会调用adapter的service方法

CoyoteAdapter

tomcat-embed-core-8.5.23-sources.jar!/org/apache/catalina/connector/CoyoteAdapter.java

    @Overridepublic void service(org.apache.coyote.Request req, org.apache.coyote.Response res)throws Exception {Request request = (Request) req.getNote(ADAPTER_NOTES);Response response = (Response) res.getNote(ADAPTER_NOTES);//...try {// Parse and set Catalina and configuration specific// request parameterspostParseSuccess = postParseRequest(req, request, res, response);if (postParseSuccess) {//check valves if we support asyncrequest.setAsyncSupported(connector.getService().getContainer().getPipeline().isAsyncSupported());// Calling the containerconnector.getService().getContainer().getPipeline().getFirst().invoke(request, response);}if (request.isAsync()) {async = true;ReadListener readListener = req.getReadListener();if (readListener != null && request.isFinished()) {// Possible the all data may have been read during service()// method so this needs to be checked hereClassLoader oldCL = null;try {oldCL = request.getContext().bind(false, null);if (req.sendAllDataReadEvent()) {req.getReadListener().onAllDataRead();}} finally {request.getContext().unbind(false, oldCL);}}Throwable throwable =(Throwable) request.getAttribute(RequestDispatcher.ERROR_EXCEPTION);// If an async request was started, is not going to end once// this container thread finishes and an error occurred, trigger// the async error processif (!request.isAsyncCompleting() && throwable != null) {request.getAsyncContextInternal().setErrorState(throwable, true);}} else {request.finishRequest();response.finishResponse();}} catch (IOException e) {// Ignore} finally {//......// Recycle the wrapper request and responseif (!async) {request.recycle();response.recycle();}}}

会在finally里头调用request.recycle()

Request#recycle

tomcat-embed-core-8.5.23-sources.jar!/org/apache/catalina/connector/Request.java 里头的方法会调用recycleSessionInfo

protected void recycleSessionInfo() {if (session != null) {try {session.endAccess();} catch (Throwable t) {ExceptionUtils.handleThrowable(t);log.warn(sm.getString("coyoteRequest.sessionEndAccessFail"), t);}}session = null;requestedSessionCookie = false;requestedSessionId = null;requestedSessionURL = false;requestedSessionSSL = false;}

这里就更新了两个事件

forward中更新

适合处理error直接forward的情况，比如鉴权不通过，直接forward的，这个时候还没进入到servlet的service方法

ApplicationDispatcher#recycleRequestWrapper

tomcat-embed-core-8.5.23-sources.jar!/org/apache/catalina/core/ApplicationDispatcher.java

private void invoke(ServletRequest request, ServletResponse response,State state) throws IOException, ServletException {//......// Get the FilterChain HereApplicationFilterChain filterChain =ApplicationFilterFactory.createFilterChain(request, wrapper, servlet);// Call the service() method for the allocated servlet instancetry {// for includes/forwardsif ((servlet != null) && (filterChain != null)) {filterChain.doFilter(request, response);}// Servlet Service Method is called by the FilterChain} catch (ClientAbortException e) {ioException = e;} catch (IOException e) {wrapper.getLogger().error(sm.getString("applicationDispatcher.serviceException",wrapper.getName()), e);ioException = e;} catch (UnavailableException e) {wrapper.getLogger().error(sm.getString("applicationDispatcher.serviceException",wrapper.getName()), e);servletException = e;wrapper.unavailable(e);} catch (ServletException e) {Throwable rootCause = StandardWrapper.getRootCause(e);if (!(rootCause instanceof ClientAbortException)) {wrapper.getLogger().error(sm.getString("applicationDispatcher.serviceException",wrapper.getName()), rootCause);}servletException = e;} catch (RuntimeException e) {wrapper.getLogger().error(sm.getString("applicationDispatcher.serviceException",wrapper.getName()), e);runtimeException = e;}// Release the filter chain (if any) for this requesttry {if (filterChain != null)filterChain.release();} catch (Throwable e) {ExceptionUtils.handleThrowable(e);wrapper.getLogger().error(sm.getString("standardWrapper.releaseFilters",wrapper.getName()), e);// FIXME: Exception handling needs to be similar to what is in the StandardWrapperValue}// Deallocate the allocated servlet instancetry {if (servlet != null) {wrapper.deallocate(servlet);}} catch (ServletException e) {wrapper.getLogger().error(sm.getString("applicationDispatcher.deallocateException",wrapper.getName()), e);servletException = e;} catch (Throwable e) {ExceptionUtils.handleThrowable(e);wrapper.getLogger().error(sm.getString("applicationDispatcher.deallocateException",wrapper.getName()), e);servletException = new ServletException(sm.getString("applicationDispatcher.deallocateException",wrapper.getName()), e);}// Reset the old context class loadercontext.unbind(false, oldCCL);// Unwrap request/response if needed// See Bugzilla 30949unwrapRequest(state);unwrapResponse(state);// Recycle request if necessary (also BZ 30949)recycleRequestWrapper(state);// ......}

执行完servlet之后(不管成功还是失败)，会调用recycleRequestWrapper

private void recycleRequestWrapper(State state) {if (state.wrapRequest instanceof ApplicationHttpRequest) {((ApplicationHttpRequest) state.wrapRequest).recycle();        }}

tomcat-embed-core-8.5.23-sources.jar!/org/apache/catalina/core/ApplicationHttpRequest.java

    /*** Recycle this request*/public void recycle() {if (session != null) {session.endAccess();}}

这里会调用endAccess，更新两个时间

小结

• 每次的请求，都会跟新session的lastAccessedTime和thisAccessedTime，只有没有访问超过设定时间才会失效
• server.session.timeout设定的单位是秒，但是小于60的话，会被重置为60，内部转为分钟单位来算，默认1800是30分钟