序

本文主要介绍下spring boot中对session timeout参数值的设置过程。

ServerProperties

spring-boot-autoconfigure-1.5.8.RELEASE-sources.jar!/org/springframework/boot/autoconfigure/web/ServerProperties.java

@Override    public void customize(ConfigurableEmbeddedServletContainer container) {        if (getPort() != null) {            container.setPort(getPort());        }        if (getAddress() != null) {            container.setAddress(getAddress());        }        if (getContextPath() != null) {            container.setContextPath(getContextPath());        }        if (getDisplayName() != null) {            container.setDisplayName(getDisplayName());        }        if (getSession().getTimeout() != null) {            container.setSessionTimeout(getSession().getTimeout());        }        //......    }

对应的配置如下

server.session.timeout=120

需要注意单位是秒

TomcatEmbeddedServletContainerFactory

spring-boot-1.5.8.RELEASE-sources.jar!/org/springframework/boot/context/embedded/tomcat/TomcatEmbeddedServletContainerFactory.java

protected void configureContext(Context context,            ServletContextInitializer[] initializers) {        TomcatStarter starter = new TomcatStarter(initializers);        if (context instanceof TomcatEmbeddedContext) {            // Should be true            ((TomcatEmbeddedContext) context).setStarter(starter);        }        context.addServletContainerInitializer(starter, NO_CLASSES);        for (LifecycleListener lifecycleListener : this.contextLifecycleListeners) {            context.addLifecycleListener(lifecycleListener);        }        for (Valve valve : this.contextValves) {            context.getPipeline().addValve(valve);        }        for (ErrorPage errorPage : getErrorPages()) {            new TomcatErrorPage(errorPage).addToContext(context);        }        for (MimeMappings.Mapping mapping : getMimeMappings()) {            context.addMimeMapping(mapping.getExtension(), mapping.getMimeType());        }        configureSession(context);        for (TomcatContextCustomizer customizer : this.tomcatContextCustomizers) {            customizer.customize(context);        }    }private void configureSession(Context context) {        long sessionTimeout = getSessionTimeoutInMinutes();        context.setSessionTimeout((int) sessionTimeout);        if (isPersistSession()) {            Manager manager = context.getManager();            if (manager == null) {                manager = new StandardManager();                context.setManager(manager);            }            configurePersistSession(manager);        }        else {            context.addLifecycleListener(new DisablePersistSessionListener());        }    }private long getSessionTimeoutInMinutes() {        long sessionTimeout = getSessionTimeout();        if (sessionTimeout > 0) {            sessionTimeout = Math.max(TimeUnit.SECONDS.toMinutes(sessionTimeout), 1L);        }        return sessionTimeout;    }

这里要注意一下，它内部转成分钟，然后设置给tomcat原生的StandardContext

可以从源码看到，如果设置小于60秒的话，则会默认取1分钟

StandardContext

tomcat-embed-core-8.5.23-sources.jar!/org/apache/catalina/core/StandardContext.java

@Override    public void setSessionTimeout(int timeout) {        int oldSessionTimeout = this.sessionTimeout;        /*         * SRV.13.4 ("Deployment Descriptor"):         * If the timeout is 0 or less, the container ensures the default         * behaviour of sessions is never to time out.         */        this.sessionTimeout = (timeout == 0) ? -1 : timeout;        support.firePropertyChange("sessionTimeout",                                   oldSessionTimeout,                                   this.sessionTimeout);    }

这一步就是设置给原生的tomcat的StandardContext

session失效的计算

tomcat-embed-core-8.5.23-sources.jar!/org/apache/catalina/session/StandardSession.java

/**     * Return the isValid flag for this session.     */    @Override    public boolean isValid() {        if (!this.isValid) {            return false;        }        if (this.expiring) {            return true;        }        if (ACTIVITY_CHECK && accessCount.get() > 0) {            return true;        }        if (maxInactiveInterval > 0) {            int timeIdle = (int) (getIdleTimeInternal() / 1000L);            if (timeIdle >= maxInactiveInterval) {                expire(true);            }        }        return this.isValid;    }

这里会去计算timeIdle，然后通过timeIdle的值跟设定的session timeout比较，超出则设置session失效

getIdleTimeInternal

/**     * Return the idle time from last client access time without invalidation check     * @see #getIdleTime()     */    @Override    public long getIdleTimeInternal() {        long timeNow = System.currentTimeMillis();        long timeIdle;        if (LAST_ACCESS_AT_START) {            timeIdle = timeNow - lastAccessedTime;        } else {            timeIdle = timeNow - thisAccessedTime;        }        return timeIdle;    }

维护了两个变量，一个是lastAccessedTime，一个是thisAccessedTime

这个是在这个方法中更新

/**     * End the access.     */    @Override    public void endAccess() {        isNew = false;        /**         * The servlet spec mandates to ignore request handling time         * in lastAccessedTime.         */        if (LAST_ACCESS_AT_START) {            this.lastAccessedTime = this.thisAccessedTime;            this.thisAccessedTime = System.currentTimeMillis();        } else {            this.thisAccessedTime = System.currentTimeMillis();            this.lastAccessedTime = this.thisAccessedTime;        }        if (ACTIVITY_CHECK) {            accessCount.decrementAndGet();        }    }

正常请求更新

Http11Processor

tomcat-embed-core-8.5.23-sources.jar!/org/apache/coyote/http11/Http11Processor.java

@Override    public SocketState service(SocketWrapperBase
     socketWrapper)        throws IOException {        //......        while (!getErrorState().isError() && keepAlive && !isAsync() && upgradeToken == null &&                sendfileState == SendfileState.DONE && !endpoint.isPaused()) {            // ......            // Process the request in the adapter            if (!getErrorState().isError()) {                try {                    rp.setStage(org.apache.coyote.Constants.STAGE_SERVICE);                    getAdapter().service(request, response);                    // Handle when the response was committed before a serious                    // error occurred.  Throwing a ServletException should both                    // set the status to 500 and set the errorException.                    // If we fail here, then the response is likely already                    // committed, so we can't try and set headers.                    if(keepAlive && !getErrorState().isError() && !isAsync() &&                            statusDropsConnection(response.getStatus())) {                        setErrorState(ErrorState.CLOSE_CLEAN, null);                    }                } catch (InterruptedIOException e) {                    setErrorState(ErrorState.CLOSE_CONNECTION_NOW, e);                } catch (HeadersTooLargeException e) {                    log.error(sm.getString("http11processor.request.process"), e);                    // The response should not have been committed but check it                    // anyway to be safe                    if (response.isCommitted()) {                        setErrorState(ErrorState.CLOSE_NOW, e);                    } else {                        response.reset();                        response.setStatus(500);                        setErrorState(ErrorState.CLOSE_CLEAN, e);                        response.setHeader("Connection", "close"); // TODO: Remove                    }                } catch (Throwable t) {                    ExceptionUtils.handleThrowable(t);                    log.error(sm.getString("http11processor.request.process"), t);                    // 500 - Internal Server Error                    response.setStatus(500);                    setErrorState(ErrorState.CLOSE_CLEAN, t);                    getAdapter().log(request, response, 0);                }            }            // Finish the handling of the request            rp.setStage(org.apache.coyote.Constants.STAGE_ENDINPUT);            if (!isAsync()) {                // If this is an async request then the request ends when it has                // been completed. The AsyncContext is responsible for calling                // endRequest() in that case.                endRequest();            }                        //......        }        //......    }

这里的service方法在getErrorState().isError()为false的时候，会调用adapter的service方法

CoyoteAdapter

tomcat-embed-core-8.5.23-sources.jar!/org/apache/catalina/connector/CoyoteAdapter.java

@Override    public void service(org.apache.coyote.Request req, org.apache.coyote.Response res)            throws Exception {        Request request = (Request) req.getNote(ADAPTER_NOTES);        Response response = (Response) res.getNote(ADAPTER_NOTES);        //...        try {            // Parse and set Catalina and configuration specific            // request parameters            postParseSuccess = postParseRequest(req, request, res, response);            if (postParseSuccess) {                //check valves if we support async                request.setAsyncSupported(                        connector.getService().getContainer().getPipeline().isAsyncSupported());                // Calling the container                connector.getService().getContainer().getPipeline().getFirst().invoke(                        request, response);            }            if (request.isAsync()) {                async = true;                ReadListener readListener = req.getReadListener();                if (readListener != null && request.isFinished()) {                    // Possible the all data may have been read during service()                    // method so this needs to be checked here                    ClassLoader oldCL = null;                    try {                        oldCL = request.getContext().bind(false, null);                        if (req.sendAllDataReadEvent()) {                            req.getReadListener().onAllDataRead();                        }                    } finally {                        request.getContext().unbind(false, oldCL);                    }                }                Throwable throwable =                        (Throwable) request.getAttribute(RequestDispatcher.ERROR_EXCEPTION);                // If an async request was started, is not going to end once                // this container thread finishes and an error occurred, trigger                // the async error process                if (!request.isAsyncCompleting() && throwable != null) {                    request.getAsyncContextInternal().setErrorState(throwable, true);                }            } else {                request.finishRequest();                response.finishResponse();            }        } catch (IOException e) {            // Ignore        } finally {            //......            // Recycle the wrapper request and response            if (!async) {                request.recycle();                response.recycle();            }        }    }

会在finally里头调用request.recycle()

Request#recycle

tomcat-embed-core-8.5.23-sources.jar!/org/apache/catalina/connector/Request.java

里头的方法会调用recycleSessionInfo

protected void recycleSessionInfo() {        if (session != null) {            try {                session.endAccess();            } catch (Throwable t) {                ExceptionUtils.handleThrowable(t);                log.warn(sm.getString("coyoteRequest.sessionEndAccessFail"), t);            }        }        session = null;        requestedSessionCookie = false;        requestedSessionId = null;        requestedSessionURL = false;        requestedSessionSSL = false;    }

这里就更新了两个事件

forward中更新

适合处理error直接forward的情况，比如鉴权不通过，直接forward的，这个时候还没进入到servlet的service方法

ApplicationDispatcher#recycleRequestWrapper

tomcat-embed-core-8.5.23-sources.jar!/org/apache/catalina/core/ApplicationDispatcher.java

private void invoke(ServletRequest request, ServletResponse response,            State state) throws IOException, ServletException {        //......        // Get the FilterChain Here        ApplicationFilterChain filterChain =                ApplicationFilterFactory.createFilterChain(request, wrapper, servlet);        // Call the service() method for the allocated servlet instance        try {            // for includes/forwards            if ((servlet != null) && (filterChain != null)) {               filterChain.doFilter(request, response);             }            // Servlet Service Method is called by the FilterChain        } catch (ClientAbortException e) {            ioException = e;        } catch (IOException e) {            wrapper.getLogger().error(sm.getString("applicationDispatcher.serviceException",                             wrapper.getName()), e);            ioException = e;        } catch (UnavailableException e) {            wrapper.getLogger().error(sm.getString("applicationDispatcher.serviceException",                             wrapper.getName()), e);            servletException = e;            wrapper.unavailable(e);        } catch (ServletException e) {            Throwable rootCause = StandardWrapper.getRootCause(e);            if (!(rootCause instanceof ClientAbortException)) {                wrapper.getLogger().error(sm.getString("applicationDispatcher.serviceException",                        wrapper.getName()), rootCause);            }            servletException = e;        } catch (RuntimeException e) {            wrapper.getLogger().error(sm.getString("applicationDispatcher.serviceException",                             wrapper.getName()), e);            runtimeException = e;        }        // Release the filter chain (if any) for this request        try {            if (filterChain != null)                filterChain.release();        } catch (Throwable e) {            ExceptionUtils.handleThrowable(e);            wrapper.getLogger().error(sm.getString("standardWrapper.releaseFilters",                             wrapper.getName()), e);            // FIXME: Exception handling needs to be similar to what is in the StandardWrapperValue        }        // Deallocate the allocated servlet instance        try {            if (servlet != null) {                wrapper.deallocate(servlet);            }        } catch (ServletException e) {            wrapper.getLogger().error(sm.getString("applicationDispatcher.deallocateException",                             wrapper.getName()), e);            servletException = e;        } catch (Throwable e) {            ExceptionUtils.handleThrowable(e);            wrapper.getLogger().error(sm.getString("applicationDispatcher.deallocateException",                             wrapper.getName()), e);            servletException = new ServletException                (sm.getString("applicationDispatcher.deallocateException",                              wrapper.getName()), e);        }        // Reset the old context class loader        context.unbind(false, oldCCL);        // Unwrap request/response if needed        // See Bugzilla 30949        unwrapRequest(state);        unwrapResponse(state);        // Recycle request if necessary (also BZ 30949)        recycleRequestWrapper(state);        // ......    }

执行完servlet之后(不管成功还是失败)，会调用recycleRequestWrapper

private void recycleRequestWrapper(State state) {        if (state.wrapRequest instanceof ApplicationHttpRequest) {            ((ApplicationHttpRequest) state.wrapRequest).recycle();        }    }

tomcat-embed-core-8.5.23-sources.jar!/org/apache/catalina/core/ApplicationHttpRequest.java

/**     * Recycle this request     */    public void recycle() {        if (session != null) {            session.endAccess();        }    }

这里会调用endAccess，更新两个时间

小结

• 每次的请求，都会跟新session的lastAccessedTime和thisAccessedTime，只有没有访问超过设定时间才会失效
• server.session.timeout设定的单位是秒，但是小于60的话，会被重置为60，内部转为分钟单位来算，默认1800是30分钟