java gwt rpc 中的会话 ID cookie
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/1382088/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
session id cookie in gwt rpc
提问by antony.trupe
Assuming I'm rolling my own session code, what's the right way to generate a unique and secure session id cookie in java.
假设我正在滚动自己的会话代码，那么在 java 中生成唯一且安全的会话 id cookie 的正确方法是什么？
Should I not be rolling my own but using something that's already been standardized?
我不应该自己滚动而是使用已经标准化的东西吗？
I'm using gwt and the google app-engine platform.
我正在使用 gwt 和谷歌应用引擎平台。
How do I make sessions persist across browser/server restarts?
如何使会话在浏览器/服务器重启后持续存在？
回答by antony.trupe
In the remote service implementation class:
在远程服务实现类中：
String jSessionId=this.getThreadLocalRequest().getSession().getId();
In the client code:
在客户端代码中：
String jSessionId=Cookies.getCookie("JSESSIONID");
appengine-web.xml
appengine-web.xml
<sessions-enabled>true</sessions-enabled>
回答by Noon Silk
No, you shouldn't be rolling your own.
不，你不应该自己滚动。
The session ID needs to be cryptographically random (not guessable from known sources). It's difficult to get this right yourself.
会话 ID 需要加密随机（无法从已知来源猜测）。自己很难做到这一点。
回答by Vineet Reynolds
Ideally you should be relying on the underlying framework's session management features. Servlets & JSPs, Struts and Spring have this support, which you should use.
理想情况下，您应该依赖底层框架的会话管理功能。Servlets & JSPs、Struts 和 Spring 有这种支持，你应该使用它。
In the extremely rare case that you are writing your own framework with no underlying session management features to rely on, you could start with the java.security.SecureRandom class to begin with. Of course, don't reinvent the wheel here, for broken session management is the same as broken authentication.
在极少数情况下，您正在编写自己的框架而没有可依赖的底层会话管理功能，您可以从 java.security.SecureRandom 类开始。当然，不要在这里重新发明轮子，因为断开的会话管理与断开的身份验证相同。
Update
更新
Given that you are using Google App Engine, you should rely on the session management features provided by the engine. It seems that it is not switched on by default.
鉴于您使用的是 Google App Engine，您应该依赖引擎提供的会话管理功能。好像默认没有开启。
