java accesstoken防止窃取 java防止用户重复登录

经过两天的研究,下面给两个方法.不个是webwork版本的,一个是修改过后的网上的意见监听器版本的

(一) 首先先上自己的研究成果

1：首先在baseAction 中或者直接在action中写一个方法,和一个静态map(保存唯一的session)

静态map

Java代码

privatestaticMap httpssessionmap =newHashtable();//避免重复登录
private static Map httpssessionmap = new Hashtable(); //避免重复登录

2：主方法(给一个返回值是为了给提示)

Java代码

publicInteger loginMethod(LoginInfo loginfo,Users user)throwsException{
intreturnnum=0;
if(httpssessionmap.containsKey(user.getUser_code())){
//qztc_LogInfo(user, (String)httpssessionmap.get(user.getUser_code()).getAttribute(LOGIN_IP));
try{//获取session
logger.info("因在其它地方重新登录被系统强制退出");
httpssessionmap.get(user.getUser_code()).removeAttribute(LOGIN_INFO);
}catch(Exception e){
e.printStackTrace();
}
httpssessionmap.remove(user.getUser_code());
if(pcount >0)
pcount--;
Thread.sleep(10);
returnnum=1;
}
set(LOGIN_INFO,loginfo);
//set(LOGIN_INFO, new LoginInfo(user));
//set(LOGIN_IP, this.getIPAddress());
httpssessionmap.put(user.getUser_code(), getHttpSession());
pcount++;
info(getLogPrex_().append("进入系统").toString());
//info(this.LOG_TYPE_LONGIN, "进入系统");
returnreturnnum;
}
public Integer loginMethod(LoginInfo loginfo,Users user) throws Exception{
int returnnum=0;
if(httpssessionmap.containsKey(user.getUser_code())){
//qztc_LogInfo(user, (String)httpssessionmap.get(user.getUser_code()).getAttribute(LOGIN_IP));
try{//获取session
logger.info("因在其它地方重新登录被系统强制退出");
httpssessionmap.get(user.getUser_code()).removeAttribute(LOGIN_INFO);
}catch(Exception e){
e.printStackTrace();
}
httpssessionmap.remove(user.getUser_code());
if (pcount > 0)
pcount--;
Thread.sleep(10);
returnnum=1;
}
set(LOGIN_INFO,loginfo);
//set(LOGIN_INFO, new LoginInfo(user));
//set(LOGIN_IP, this.getIPAddress());
httpssessionmap.put(user.getUser_code(), getHttpSession());
pcount++;
info(getLogPrex_().append("进入系统").toString());
//info(this.LOG_TYPE_LONGIN, "进入系统");
return returnnum;
}
3：获得登录用户的唯一session
Java代码 
protectedHttpSession getHttpSession(){
returnServletActionContext.getRequest().getSession();
}
protected HttpSession getHttpSession(){
return ServletActionContext.getRequest().getSession();
}
4:set方法,设置session
Java代码 
protectedvoidset(String name, Object value)
{
ActionContext.getContext().getSession().put(name, value);
}
protected void set(String name, Object value)
{
ActionContext.getContext().getSession().put(name, value);
}

5：说明: 最后可以在 用户登录的action中

调这个baseaction方法...接下来该干嘛干嘛去..

(二) 网上哥们给的意见 http://sunxin.org/forum/thread/22787.html(回帖的用户"钟爱java

") 应该是忘记session失效的问题了.

先上代码(代码整理得我都吐血了.) --接下来都是原话

SessionListener.java监听session的类,部署于/App/WEB-INF/classes/com/test下(其中App为你的应用程序目录)

Java代码

packagecom.test;
importjavax.servlet.http.*;
importjava.util.*;
publicclassSessionListenerimplementsHttpSessionListener{privatestaticHashMap hUserName =newHashMap();//保存sessionID和username的映射
publicvoidsessionCreated(HttpSessionEvent se){
}
publicvoidsessionDestroyed(HttpSessionEvent se)
{
hUserName.remove( se.getSession().getId() );
}
publicstaticbooleanisAlreadyEnter(HttpSession session,String sUserName,LoginInfo loginfo){
booleanflag =false;
if(hUserName.containsValue(sUserName)){
//如果该用户已经登录过，则使上次登录的用户掉线(依据使用户名是否在hUserName中)
flag =true;
//遍历原来的hUserName，删除原用户名对应的sessionID(即删除原来的sessionID和username)
Iterator iter = hUserName.entrySet().iterator();
while(iter.hasNext()) {
Map.Entry entry = (Map.Entry)iter.next();
Object key = entry.getKey();
Object val = entry.getValue();
if( ( (String)val ).equals(sUserName) ){
hUserName.remove(key);
}
}
hUserName.put( session.getId(),sUserName );//添加现在的sessionID和username
System.out.println("hUserName = "+ hUserName);
}
else{
//如果该用户没登录过，直接添加现在的sessionID和username
flag =false;
((ActionContext) session).put(LOGIN_INFO, loginfo);
hUserName.put( session.getId(),sUserName );
System.out.println("hUserName = "+ hUserName);
}
returnflag;
}
publicstaticbooleanisOnline(HttpSession session){
booleanflag =true;
if( hUserName.containsKey( session.getId() ) ){
flag =true;
}else{
flag =false;
}
returnflag;
}
}
package com.test;
import javax.servlet.http.*;
import java.util.*;
public class SessionListener implements HttpSessionListener{ private static HashMap hUserName = new HashMap();//保存sessionID和username的映射
public void sessionCreated(HttpSessionEvent se){
}
public void sessionDestroyed(HttpSessionEvent se)
{
hUserName.remove( se.getSession().getId() );
}
public static boolean isAlreadyEnter(HttpSession session,String sUserName,LoginInfo loginfo){
boolean flag = false;
if(hUserName.containsValue(sUserName)){
//如果该用户已经登录过，则使上次登录的用户掉线(依据使用户名是否在hUserName中)
flag = true;
//遍历原来的hUserName，删除原用户名对应的sessionID(即删除原来的sessionID和username)
Iterator iter = hUserName.entrySet().iterator();
while (iter.hasNext()) {
Map.Entry entry = (Map.Entry)iter.next();
Object key = entry.getKey();
Object val = entry.getValue();
if( ( (String)val ).equals(sUserName) ){
hUserName.remove(key);
}
}
hUserName.put( session.getId(),sUserName );//添加现在的sessionID和username
System.out.println("hUserName = " + hUserName);
}
else{
//如果该用户没登录过，直接添加现在的sessionID和username
flag = false;
((ActionContext) session).put(LOGIN_INFO, loginfo);
hUserName.put( session.getId(),sUserName );
System.out.println("hUserName = " + hUserName);
}
return flag;
}
public static boolean isOnline(HttpSession session){
boolean flag = true;
if( hUserName.containsKey( session.getId() ) ){
flag = true;
} else{
flag = false;
}
return flag;
}
}

web.xml部署于/App/WEB-INF下

Xml代码

<?xmlversion ="1.0"encoding="ISO-8859-1"?>web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/j2ee/dtds/web-app_2.3.dtd">
com.inspirer.dbmp.SessionListener
com.inspirer.dbmp.SessionListener

应用部分 1.在你的登录验证时,调用SessionListener.isAlreadyEnter(session,"admin") 既可以判断该用户名的用户是否登录过,又可以使上次登录的用户掉线

2.其他页面调用SessionListener.isOnline(session),可以判断该用户是否在线.