java Web 应用程序中的共享会话
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/16060390/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
sharing session in web applications
提问by Bhushan
I am developing A Web Application using JSP& Servlets(Container: Tomcat7, Database: Oracle10)
我正在使用JSP& Servlets(Container: Tomcat7, Database: Oracle10)开发 Web 应用程序
I have developed some web applications like Profile, Reports, Leads. Then I have developed A Loginapplication. In this application I am storing USERIDin Sessionwith some more session attributes.
我开发了一些 Web 应用程序，例如Profile、Reports、Leads。然后我开发了一个Login应用程序。在这种应用中，我存储USERID在Session一些更多的会话属性。
After user logs in he will be shown menu which contains links to other Applications like links to ProfileApplication.
用户登录后，他将看到菜单，其中包含指向其他应用程序的链接，例如指向Profile应用程序的链接。
So when I access Sessionafter user log in:
所以当我Session在用户登录后访问时：
- If I try to access session withing the same application(Login) then I get session with all the required attributes
- But when I try to access session from other applications like
Profilesthen I get session asnull
- 如果我尝试使用相同的应用程序（登录）访问会话，那么我将获得具有所有必需属性的会话
- 但是当我尝试从其他应用程序访问会话时，
Profiles我将会话作为null
code snippet to check session(Servlet Filter in Login web application)
检查会话的代码片段（登录 Web 应用程序中的 Servlet 过滤器）
HttpSession session = request.getSession(false);
if(session==null)
{
System.out.println("Session does not exist... Redirected to LOGIN Page.");
response.sendRedirect("/ApplicationName/Login.jsp");
}
I am accessing session in Profileapplication to check whether user is logged in or not.
我正在访问Profile应用程序中的会话以检查用户是否已登录。
Then I have searched, and I have found that Sessioncan't be accessed from other applications for security reasons.(I have also found that it can be done by setting crossContext="true")
然后我搜索了一下，发现Session出于安全原因不能从其他应用程序访问。（我也发现可以通过设置来实现crossContext="true"）
Then I have found other option like making EARof all applications and then deploy it, but unfortunately EARit is not supported by Tomcat7.
然后我找到了其他选项，例如制作EAR所有应用程序然后部署它，但不幸的EAR是它不受Tomcat7.
I am new to web environment, so if anyone has worked on this before then please let me know what can be the options?
我是网络环境的新手，所以如果有人之前做过这方面的工作，请告诉我有哪些选择？
Thanks in advance
提前致谢
Update1
更新1
Now I have decided to use EAR, in which I will pack all WARfiles and then I will try to share session between them. since Tomcat doesn't support EARI have installed Oracle Glassfish, Then I have created Enterprise Application Projectwhich contains two Applications 1. Loginand 2. Profiles, and then created EARfile, and deployed it on Glassfish.
So I want to share session between those two applications(on Glassfish), so if anybody has any idea about it then please let me know. (link to any tutorial will also be appreciated)
现在我决定使用EAR，我将打包所有WAR文件，然后尝试在它们之间共享会话。由于Tomcat不支持EAR我已经安装Oracle Glassfish，然后我创建了Enterprise Application Project其中包含两个应用程序1. Login和2. Profiles，然后创建了EAR文件，并将其部署在Glassfish. 所以我想在这两个应用程序（在 Glassfish 上）之间共享会话，所以如果有人对此有任何想法，请告诉我。（链接到任何教程也将不胜感激）
采纳答案by Mahesh Guruswamy
The way I have seen this done in my shop is to stuff the login credentials into an encrypted cookie and install agents (java filters, web servers mods etc, in front of the applications that need the user data) that will decrypt the cookies and pass along the data to the downstream applications. Do not store login information in HTTP session if you want to share it across applications.
我在我的商店看到这样做的方法是将登录凭据填充到加密的 cookie 中并安装代理（java 过滤器、Web 服务器 mods 等，在需要用户数据的应用程序前面）将解密 cookie 并通过沿着数据传输到下游应用程序。如果要跨应用程序共享登录信息，请不要将登录信息存储在 HTTP 会话中。
回答by Michael
As pointed above, the requirement you talking about is Single Sign On (SSO). The simplest SSO that you can implement is the following:
如上所述，您所说的要求是单点登录 (SSO)。您可以实施的最简单的 SSO 如下：
- After the successful authentication add the cookie with the encrypted user name (you do not need to encrypt a password)
- If you access any of your application with the user name cookie and success to decrypt it, it means that a user was authenticated and you should not show the login page.
- 认证成功后添加加密用户名的cookie（不需要加密密码）
- 如果您使用用户名 cookie 访问任何应用程序并成功解密它，则意味着用户已通过身份验证，您不应显示登录页面。
Use AES-256 for the encryption.
使用 AES-256 进行加密。
