I made an API server for mobile calls, used Spring Session to connect Redis to share sessions with multiple tomcats, used security to intercept API permissions, and used x-auth-token, which is the header. Token verification. Now I am encountering a problem. Some APIs are not authorized for verification. However, when accessing these APIs, spring will create a session for each request and return a new x-auth-token. This may lead to too many sessions. Please tell me. How to configure it so that this situation does not require creating a session? Create-session="never" has been configured, but it doesn't work. The following is the security configuration
<http realm="Protected API" use-expressions="true" auto-config="false"
create-session="never" entry-point-ref="customAuthenticationEntryPoint">
<intercept-url pattern="/auth/login/phone" access="permitAll()" />
<intercept-url pattern="/**" access="isAuthenticated()" />
<access-denied-handler ref="customAccessDeniedHandler" />
</http>spring session
<!-- 在HTTP的header中使用x-auth-token:來實現session -->
<bean class="org.springframework.session.web.http.HeaderHttpSessionStrategy" />
<!-- This is essential to make sure that the Spring Security session registry
is notified when the session is destroyed. -->
<bean
class="org.springframework.security.web.session.HttpSessionEventPublisher" />
<bean class="org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration" scope="singleton">
<!-- session为60分钟过期 -->
<property name="maxInactiveIntervalInSeconds" value="${session.maxInactiveIntervalInSeconds}"></property>
</bean>
...
省略redis pool配置
![[Web front-end] Node.js quick start](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
I found the reason. First open the trace of the log, and then trace org.springframework. At this time, you can see that there will be a log every time a new session is created, and spring will print the session creation stack
You can find the line xxx.xxxx in it. Check the code in LogFilter line 52 and find that req.getSession() is called. Although create-session is configured with never, if there is code that calls req.getSession(), spring will still create a new one. session. Try not to call req.getSession() in global interceptors such as filters, otherwise a new session will be created at any time