主要继承HttpServletRequestWrapper后取得对应的session后进行自定义业务处理
public class SessionInvalidationFilter implements Filter {
private static final Logger LOGGER = Logger.getLogger(SessionInvalidationFilter.class);
private static final String LAST_ACCESS_SESSION_ATTR = "lastAccessTime";
private static final long SESSION_TIMEOUT = 1000 * 60 * 20; // 20 minutes
private static final String IGNORE_ACCESS_URI = "/user/checkUserLoginStatus";
@Override
public void init(FilterConfig arg0) throws ServletException {
}
@Override
public void destroy() {
}
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
// Cast to HTTP request and response
HttpServletRequest httpRequest = (HttpServletRequest) request;
HttpServletResponse httpResponse = (HttpServletResponse) response;
// Check if we are handling standard request
LOGGER.info("请求地址："+httpRequest.getServletPath());
if (!IGNORE_ACCESS_URI.equals(httpRequest.getServletPath())) {
chain.doFilter(new SessionAccessAwareRequest(httpRequest), response);
return;
}
// Now we can handle the special case of non-tracked request
boolean expired = false;
HttpSession session = httpRequest.getSession(false);
if (session == null) {
// No session means the AJAX contained no or incorrect JSESSIONID
expired = true;
} else {
Long lastAccessTime = (Long) session.getAttribute(LAST_ACCESS_SESSION_ATTR);
if (lastAccessTime == null || lastAccessTime + SESSION_TIMEOUT < System.currentTimeMillis()) {
LOGGER.info("设置session失效"+timeOut);
session.invalidate(); // Invalidate manually
expired = true;
}
}
// Handle error or process normally
if (expired) {
Map<String,Object> result = new HashMap<String,Object>();
//返回302状态码，跳转首页
result.put("status", 302);
result.put("message", "会话超时，请重新登录！");
result.put("success", false);
httpResponse.setContentType("application/json;charset=utf-8");
httpResponse.getWriter().println(JSONObject.toJSONString(result));
httpResponse.flushBuffer();
httpResponse.getWriter().close();
} else {
chain.doFilter(request, response);
}
}
private static class SessionAccessAwareRequest extends HttpServletRequestWrapper {
public SessionAccessAwareRequest(HttpServletRequest request) {
super(request);
}
@Override
public HttpSession getSession() {
return getSession(true);
}
@Override
public HttpSession getSession(boolean create) {
HttpSession session = super.getSession(create);
if (session != null) {
session.setAttribute(LAST_ACCESS_SESSION_ATTR, System.currentTimeMillis());
}
return session;
}
}
}
将过滤器加入web xml
<filter>
<filter-name>SessionInvalidationFilter</filter-name>
<filter-class>xx.xx.filter.SessionInvalidationFilter</filter-class>
</filter>
