SessionInvalidationFilter.java 文件源码

@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
    HttpServletRequest request = (HttpServletRequest) servletRequest;
    HttpSession session = request.getSession(true);
    Long lastActiveObject = (Long) session.getAttribute(LAST_ACTIVE_SESSION_ATTRIBUTE);
    long currentTime = System.currentTimeMillis();

    if(lastActiveObject != null) {
        long lastActive = lastActiveObject.longValue();
        if(currentTime - lastActive > SESSION_TIMEOUT) {
            LOG.info(String.format("Invalidated session of %s due to timeout", LogUtil.getUserInfo(request)));
            session.invalidate();
            session = request.getSession(true);
        }
    }

    session.setAttribute(LAST_ACTIVE_SESSION_ATTRIBUTE, Long.valueOf(currentTime));

    filterChain.doFilter(request, servletResponse);
}