W***o
发帖数: 6519 | 1 在用java做一个简单的user log in，用户登录以后可以访问一些页面，这些页面需要
check 这个用户是否 logged in。 目前我有下面的想法（pseudo code）：
void login(username, password)
{
if (username == db.user.username && password == db.user.password)
username.session = startSession(username);
else
response.redirect("/login");
}
String startSession(String username)
{
String sessionID = encoder.encode(randomBytes, username); /* generates
a random session id*/
mysql.session_table.insert(username, sessionID); /* save the session
id to session table */
return sessionID;
}
String getSession(String username)
{
return username.session;
}
boolean isSessionNew(sessionID)
{
if (sessionID.age > threshold)
return false;
else
return true;
}
大概意思就是用程序生成一个随机的session id，然后连同用户名和timestamp存到数
据库的session table；每到一个页面，就检查一下用户是否有session以及session的
age。 这样可能会有很多和数据库交互的overhead,大侠看看有啥更简单的做法吗？ 最
好给个example，我在学RESTful | s***o
发帖数: 2191 | 2 Use signed cookie. Many Web framework provide this functionality out of box. | W***o
发帖数: 6519 | 3 谢谢，我去看看
box.
【在 s***o 的大作中提到】
: Use signed cookie. Many Web framework provide this functionality out of box.
| g*****g
发帖数: 34805 | 4 Simplest way is to use jsessionId, it's built-in in almost all java web
frameworks. In a cluster, you have a few choices, you can have sticky
session (all load balancers can do that, server remembers your session for
some time), or you can use some SSO that can generate a session on each new
node you visit.
DB check on each and every click is not recommended, it will degrade
performance considerably.
【在 W***o 的大作中提到】
: 在用java做一个简单的user log in，用户登录以后可以访问一些页面，这些页面需要
: check 这个用户是否 logged in。 目前我有下面的想法（pseudo code）：
: void login(username, password)
: {
: if (username == db.user.username && password == db.user.password)
: username.session = startSession(username);
: else
: response.redirect("/login");
: }
: String startSession(String username)
| W***o
发帖数: 6519 | 5 谢谢各位大侠指点，开眼界
new
【在 g*****g 的大作中提到】
: Simplest way is to use jsessionId, it's built-in in almost all java web
: frameworks. In a cluster, you have a few choices, you can have sticky
: session (all load balancers can do that, server remembers your session for
: some time), or you can use some SSO that can generate a session on each new
: node you visit.
: DB check on each and every click is not recommended, it will degrade
: performance considerably.
|
|
