@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests().anyRequest().authenticated()
                .and().formLogin()
//                .and().sessionManagement().maximumSessions(1)
//                .and()
                .and().csrf().disable()
                // 開(kāi)啟 session 管理
                .sessionManagement()
                // 設(shè)置同一用戶在同一時(shí)刻允許的 session 最大并發(fā)數(shù)
                .maximumSessions(1)
                // 過(guò)期會(huì)話【即被踢出的舊會(huì)話】的跳轉(zhuǎn)路徑
                .expiredUrl("/login")
        ;
    }
    
}

public abstract class AbstractAuthenticationProcessingFilter extends GenericFilterBean
		implements ApplicationEventPublisherAware, MessageSourceAware {
		
	private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
			throws IOException, ServletException {
		if (!requiresAuthentication(request, response)) {
			chain.doFilter(request, response);
			return;
		}
		try {
			// 調(diào)用具體的子類實(shí)現(xiàn)的 attemptAuthentication 方法，嘗試進(jìn)行認(rèn)證
			Authentication authenticationResult = attemptAuthentication(request, response);
			if (authenticationResult == null) {
				// return immediately as subclass has indicated that it hasn't completed
				return;
			}
			
			//【????】根據(jù)配置的 session 管理策略，對(duì) session 進(jìn)行管理
			this.sessionStrategy.onAuthentication(authenticationResult, request, response);
			// Authentication success
			if (this.continueChainBeforeSuccessfulAuthentication) {
				chain.doFilter(request, response);
			}
			// 認(rèn)證成功后的處理，主要是包含兩方面：
			// 1、rememberMe 功能的業(yè)務(wù)邏輯
			// 2、登錄成功的 handler 回調(diào)處理
			successfulAuthentication(request, response, chain, authenticationResult);
		}
		catch (InternalAuthenticationServiceException failed) {
			this.logger.error("An internal error occurred while trying to authenticate the user.", failed);
			unsuccessfulAuthentication(request, response, failed);
		}
		catch (AuthenticationException ex) {
			// Authentication failed
			unsuccessfulAuthentication(request, response, ex);
		}
	}

}

	@Override
	public void onAuthentication(Authentication authentication, HttpServletRequest request,
			HttpServletResponse response) throws SessionAuthenticationException {
		int currentPosition = 0;
		int size = this.delegateStrategies.size();
		for (SessionAuthenticationStrategy delegate : this.delegateStrategies) {
			if (this.logger.isTraceEnabled()) {
				this.logger.trace(LogMessage.format("Preparing session with %s (%d/%d)",
						delegate.getClass().getSimpleName(), ++currentPosition, size));
			}
			// 依次調(diào)用內(nèi)部的每一個(gè) Strategy 的 onAuthentication()
			delegate.onAuthentication(authentication, request, response);
		}
	}

public class ConcurrentSessionControlAuthenticationStrategy
		implements MessageSourceAware, SessionAuthenticationStrategy {

	protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();

	private final SessionRegistry sessionRegistry;

	private boolean exceptionIfMaximumExceeded = false;

	private int maximumSessions = 1;

	// 從構(gòu)造器可以看出，該策略的實(shí)例【強(qiáng)依賴】于 SessionRegistry，因此，如果我們自己創(chuàng)建該策略實(shí)例，就得先擁有 SessionRegistry 實(shí)例
	public ConcurrentSessionControlAuthenticationStrategy(SessionRegistry sessionRegistry) {
		Assert.notNull(sessionRegistry, "The sessionRegistry cannot be null");
		this.sessionRegistry = sessionRegistry;
	}


	@Override
	public void onAuthentication(Authentication authentication, HttpServletRequest request,
			HttpServletResponse response) {
		// 獲取配置的每一個(gè)用戶同一時(shí)刻允許最多登錄的端數(shù)，即并發(fā)會(huì)話的個(gè)數(shù)，也就是我們?cè)谂渲妙愔信渲玫?maximumSessions() 
		int allowedSessions = getMaximumSessionsForThisUser(authentication);
		if (allowedSessions == -1) {
			// We permit unlimited logins
			return;
		}
		// 從 sessionRegistry 中根據(jù)本次認(rèn)證的用戶信息，來(lái)獲取它關(guān)聯(lián)的所有 sessionid 集合
		// ?? 注意：由于比較的時(shí)候是去調(diào)用 key 對(duì)象的 hashcode()，因此如果是自己實(shí)現(xiàn)了 UserDetails 實(shí)例用于封裝用戶信息，必須要重寫 hashcode()
		List<SessionInformation> sessions = this.sessionRegistry.getAllSessions(authentication.getPrincipal(), false);
		int sessionCount = sessions.size();
		// 還沒(méi)有達(dá)到并發(fā)會(huì)話的最大限制數(shù)，就直接 return 了
		if (sessionCount < allowedSessions) {
			// They haven't got too many login sessions running at present
			return;
		}
		// 如果當(dāng)前已有的最大會(huì)話數(shù)已經(jīng)達(dá)到了限制的并發(fā)會(huì)話數(shù)，就判斷本次請(qǐng)求的會(huì)話的id，是否已經(jīng)囊括在已有的會(huì)話id集合中了，如果包含在其中，也不進(jìn)行后續(xù)的業(yè)務(wù)處理了，直接 return
		if (sessionCount == allowedSessions) {
			HttpSession session = request.getSession(false);
			if (session != null) {
				// Only permit it though if this request is associated with one of the
				// already registered sessions
				for (SessionInformation si : sessions) {
					if (si.getSessionId().equals(session.getId())) {
						return;
					}
				}
			}
			// If the session is null, a new one will be created by the parent class,
			// exceeding the allowed number
		}
		//【??】：如果當(dāng)前用戶所關(guān)聯(lián)的會(huì)話已經(jīng)達(dá)到了并發(fā)會(huì)話管理的限制個(gè)數(shù)，并且本次的會(huì)話不再已有的會(huì)話集合中，即本次的會(huì)話是一個(gè)新創(chuàng)建的會(huì)話，那么就會(huì)走下面的方法
		// 該方法主要是計(jì)算需要踢出多少個(gè)該用戶的舊會(huì)話來(lái)為新會(huì)話騰出空間，所謂的踢出，只是將一定數(shù)量的舊會(huì)話進(jìn)行標(biāo)識(shí)為“已過(guò)期”，真正進(jìn)行踢出動(dòng)作的不是策略本身
		allowableSessionsExceeded(sessions, allowedSessions, this.sessionRegistry);
	}

	protected int getMaximumSessionsForThisUser(Authentication authentication) {
		return this.maximumSessions;
	}

	protected void allowableSessionsExceeded(List<SessionInformation> sessions, int allowableSessions,
			SessionRegistry registry) throws SessionAuthenticationException {
		if (this.exceptionIfMaximumExceeded || (sessions == null)) {
			throw new SessionAuthenticationException(
					this.messages.getMessage("ConcurrentSessionControlAuthenticationStrategy.exceededAllowed",
							new Object[] { allowableSessions }, "Maximum sessions of {0} for this principal exceeded"));
		}
		// Determine least recently used sessions, and mark them for invalidation
		// 根據(jù)會(huì)話的最新一次活動(dòng)時(shí)間來(lái)排序
		sessions.sort(Comparator.comparing(SessionInformation::getLastRequest));
		// 當(dāng)前已有的會(huì)話數(shù) + 1【本次新創(chuàng)建的會(huì)話】- 限制的最大會(huì)話并發(fā)數(shù) = 需要踢出的舊會(huì)話個(gè)數(shù)
		int maximumSessionsExceededBy = sessions.size() - allowableSessions + 1;
		List<SessionInformation> sessionsToBeExpired = sessions.subList(0, maximumSessionsExceededBy);
		for (SessionInformation session : sessionsToBeExpired) {
			// 將 會(huì)話 的過(guò)期標(biāo)識(shí)設(shè)置為 true
			session.expireNow();
		}
	}

}

public class RegisterSessionAuthenticationStrategy implements SessionAuthenticationStrategy {

	private final SessionRegistry sessionRegistry;

	// 從構(gòu)造器可以看出，該策略的實(shí)例【強(qiáng)依賴】于 SessionRegistry，因此，如果我們自己創(chuàng)建該策略實(shí)例，就得先擁有 SessionRegistry 實(shí)例
	public RegisterSessionAuthenticationStrategy(SessionRegistry sessionRegistry) {
		Assert.notNull(sessionRegistry, "The sessionRegistry cannot be null");
		this.sessionRegistry = sessionRegistry;
	}

	@Override
	public void onAuthentication(Authentication authentication, HttpServletRequest request,
			HttpServletResponse response) {
		//負(fù)責(zé)將本次創(chuàng)建的新會(huì)話注冊(cè)進(jìn) sessionRegistry 中
		this.sessionRegistry.registerNewSession(request.getSession().getId(), authentication.getPrincipal());
	}

}

public interface SessionRegistry {
	List<Object> getAllPrincipals();
	List<SessionInformation> getAllSessions(Object principal, boolean includeExpiredSessions);
	SessionInformation getSessionInformation(String sessionId);
	void refreshLastRequest(String sessionId);
	void registerNewSession(String sessionId, Object principal);
	void removeSessionInformation(String sessionId);
}

public class SessionRegistryImpl implements SessionRegistry, ApplicationListener<AbstractSessionEvent> {

	protected final Log logger = LogFactory.getLog(SessionRegistryImpl.class);

	// <principal:Object,SessionIdSet>
	// 存儲(chǔ)了同一個(gè)用戶所關(guān)聯(lián)的所有 session 的 id 集合，以用戶實(shí)例對(duì)象的 hashcode() 返回值為 key
	private final ConcurrentMap<Object, Set<String>> principals;

	// <sessionId:Object,SessionInformation>
	// 存儲(chǔ)了每一個(gè)用戶會(huì)話的詳細(xì)信息，以 sessionId 為 key
	private final Map<String, SessionInformation> sessionIds;

	public SessionRegistryImpl() {
		this.principals = new ConcurrentHashMap<>();
		this.sessionIds = new ConcurrentHashMap<>();
	}

	public SessionRegistryImpl(ConcurrentMap<Object, Set<String>> principals,
			Map<String, SessionInformation> sessionIds) {
		this.principals = principals;
		this.sessionIds = sessionIds;
	}

	@Override
	public List<Object> getAllPrincipals() {
		return new ArrayList<>(this.principals.keySet());
	}

	// 根本 UserDetails 實(shí)例對(duì)象的 hashcode()，獲取到該用戶關(guān)聯(lián)到的所有的 Session
	@Override
	public List<SessionInformation> getAllSessions(Object principal, boolean includeExpiredSessions) {
		Set<String> sessionsUsedByPrincipal = this.principals.get(principal);
		if (sessionsUsedByPrincipal == null) {
			return Collections.emptyList();
		}
		List<SessionInformation> list = new ArrayList<>(sessionsUsedByPrincipal.size());
		for (String sessionId : sessionsUsedByPrincipal) {
			SessionInformation sessionInformation = getSessionInformation(sessionId);
			if (sessionInformation == null) {
				continue;
			}
			if (includeExpiredSessions || !sessionInformation.isExpired()) {
				list.add(sessionInformation);
			}
		}
		return list;
	}

	// 根據(jù) sessionId 獲取到具體的 Session 信息（其中包含了過(guò)期標(biāo)識(shí)位）
	@Override
	public SessionInformation getSessionInformation(String sessionId) {
		Assert.hasText(sessionId, "SessionId required as per interface contract");
		return this.sessionIds.get(sessionId);
	}

	@Override
	public void onApplicationEvent(AbstractSessionEvent event) {
		if (event instanceof SessionDestroyedEvent) {
			SessionDestroyedEvent sessionDestroyedEvent = (SessionDestroyedEvent) event;
			String sessionId = sessionDestroyedEvent.getId();
			removeSessionInformation(sessionId);
		}
		else if (event instanceof SessionIdChangedEvent) {
			SessionIdChangedEvent sessionIdChangedEvent = (SessionIdChangedEvent) event;
			String oldSessionId = sessionIdChangedEvent.getOldSessionId();
			if (this.sessionIds.containsKey(oldSessionId)) {
				Object principal = this.sessionIds.get(oldSessionId).getPrincipal();
				removeSessionInformation(oldSessionId);
				registerNewSession(sessionIdChangedEvent.getNewSessionId(), principal);
			}
		}
	}

	// 刷新會(huì)話的最新活躍時(shí)間（用于標(biāo)識(shí)過(guò)期邏輯中的排序）
	@Override
	public void refreshLastRequest(String sessionId) {
		Assert.hasText(sessionId, "SessionId required as per interface contract");
		SessionInformation info = getSessionInformation(sessionId);
		if (info != null) {
			info.refreshLastRequest();
		}
	}

	// 注冊(cè)新的用戶會(huì)話信息
	@Override
	public void registerNewSession(String sessionId, Object principal) {
		Assert.hasText(sessionId, "SessionId required as per interface contract");
		Assert.notNull(principal, "Principal required as per interface contract");
		if (getSessionInformation(sessionId) != null) {
			removeSessionInformation(sessionId);
		}
		if (this.logger.isDebugEnabled()) {
			this.logger.debug(LogMessage.format("Registering session %s, for principal %s", sessionId, principal));
		}
		this.sessionIds.put(sessionId, new SessionInformation(principal, sessionId, new Date()));
		this.principals.compute(principal, (key, sessionsUsedByPrincipal) -> {
			if (sessionsUsedByPrincipal == null) {
				sessionsUsedByPrincipal = new CopyOnWriteArraySet<>();
			}
			sessionsUsedByPrincipal.add(sessionId);
			this.logger.trace(LogMessage.format("Sessions used by '%s' : %s", principal, sessionsUsedByPrincipal));
			return sessionsUsedByPrincipal;
		});
	}

	// 移除過(guò)期的用戶會(huì)話信息
	@Override
	public void removeSessionInformation(String sessionId) {
		Assert.hasText(sessionId, "SessionId required as per interface contract");
		SessionInformation info = getSessionInformation(sessionId);
		if (info == null) {
			return;
		}
		if (this.logger.isTraceEnabled()) {
			this.logger.debug("Removing session " + sessionId + " from set of registered sessions");
		}
		this.sessionIds.remove(sessionId);
		this.principals.computeIfPresent(info.getPrincipal(), (key, sessionsUsedByPrincipal) -> {
			this.logger.debug(
					LogMessage.format("Removing session %s from principal's set of registered sessions", sessionId));
			sessionsUsedByPrincipal.remove(sessionId);
			if (sessionsUsedByPrincipal.isEmpty()) {
				// No need to keep object in principals Map anymore
				this.logger.debug(LogMessage.format("Removing principal %s from registry", info.getPrincipal()));
				sessionsUsedByPrincipal = null;
			}
			this.logger.trace(
					LogMessage.format("Sessions used by '%s' : %s", info.getPrincipal(), sessionsUsedByPrincipal));
			return sessionsUsedByPrincipal;
		});
	}

}

public class ConcurrentSessionFilter extends GenericFilterBean {

	private final SessionRegistry sessionRegistry;

	private String expiredUrl;

	private RedirectStrategy redirectStrategy;

	private LogoutHandler handlers = new CompositeLogoutHandler(new SecurityContextLogoutHandler());

	private SessionInformationExpiredStrategy sessionInformationExpiredStrategy;

	@Override
	public void afterPropertiesSet() {
		Assert.notNull(this.sessionRegistry, "SessionRegistry required");
	}

	// 過(guò)濾器嘛，最重要的就是這個(gè)方法啦
	@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
			throws IOException, ServletException {
		doFilter((HttpServletRequest) request, (HttpServletResponse) response, chain);
	}

	private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
			throws IOException, ServletException {
		// 獲取本次請(qǐng)求的 session
		HttpSession session = request.getSession(false);
		if (session != null) {
			// 判斷當(dāng)前會(huì)話是否已經(jīng)注冊(cè)進(jìn)了 sessionRegistry 數(shù)據(jù)中心
			SessionInformation info = this.sessionRegistry.getSessionInformation(session.getId());
			if (info != null) {
				// 如果已在 sessionRegistry，那么判斷下該 session 是否已經(jīng)過(guò)期了【通過(guò)前面提到的過(guò)期標(biāo)識(shí)位來(lái)判斷】
				if (info.isExpired()) {
					// Expired - abort processing
					this.logger.debug(LogMessage
							.of(() -> "Requested session ID " + request.getRequestedSessionId() + " has expired."));
					// 對(duì)于已經(jīng)過(guò)期的會(huì)話，就不放行本次請(qǐng)求了，而是對(duì)本次會(huì)話進(jìn)行 logout 處理，即注銷登錄處理【具體實(shí)現(xiàn)看下一個(gè)方法】
					doLogout(request, response);
					// 調(diào)用會(huì)話過(guò)期處理策略進(jìn)行過(guò)期業(yè)務(wù)處理
					// 如果在自定義的配置類中有顯式聲明了SessionManagementConfigurer.expiredSessionStrategy() 配置，那么此處就會(huì)去回調(diào)我們聲明的策略實(shí)現(xiàn)
					this.sessionInformationExpiredStrategy
							.onExpiredSessionDetected(new SessionInformationExpiredEvent(info, request, response));
					return;
				}
				// Non-expired - update last request date/time
				// 如果會(huì)話沒(méi)有過(guò)期，就刷新該會(huì)話的最新活躍時(shí)間【用于淘汰過(guò)期會(huì)話時(shí)排序使用】
				this.sessionRegistry.refreshLastRequest(info.getSessionId());
			}
		}
		chain.doFilter(request, response);
	}

	private void doLogout(HttpServletRequest request, HttpServletResponse response) {
		Authentication auth = SecurityContextHolder.getContext().getAuthentication();
		// 執(zhí)行 logout 操作，包括移除會(huì)話、重定向到登錄請(qǐng)求、返回注銷成功的 json 數(shù)據(jù)等
		this.handlers.logout(request, response, auth);
	}

	// SessionInformationExpiredStrategy 的私有默認(rèn)實(shí)現(xiàn)
	// 如果我們?cè)谧远x配置類中沒(méi)有指定 expiredSessionStrategy() 的具體配置，那么就會(huì)使用這個(gè)實(shí)現(xiàn)，這個(gè)實(shí)現(xiàn)不做任何業(yè)務(wù)邏輯處理，只負(fù)責(zé)打印響應(yīng)日志
	private static final class ResponseBodySessionInformationExpiredStrategy
			implements SessionInformationExpiredStrategy {

		@Override
		public void onExpiredSessionDetected(SessionInformationExpiredEvent event) throws IOException {
			HttpServletResponse response = event.getResponse();
			response.getWriter().print("This session has been expired (possibly due to multiple concurrent "
					+ "logins being attempted as the same user).");
			response.flushBuffer();
		}

	}

}

public class LoginFilter extends UsernamePasswordAuthenticationFilter {

    @Autowired
    private SessionRegistry sessionRegistry;

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        if (!request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
        }
        if (MediaType.APPLICATION_JSON_VALUE.equals(request.getContentType()) ||
                MediaType.APPLICATION_JSON_UTF8_VALUE.equals(request.getContentType())) {
            try {
                Map<String, String> map = new ObjectMapper().readValue(request.getInputStream(), Map.class);
                String username = map.get(getUsernameParameter());
                String password = map.get(getPasswordParameter());
                UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
                // Allow subclasses to set the "details" property
                setDetails(request, authRequest);
                return this.getAuthenticationManager().authenticate(authRequest);
            } catch (IOException e) {
                throw new RuntimeException(e);
            }
        }
        return super.attemptAuthentication(request, response);
    }

}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

	@Bean
    public UserDetailsService userDetailsService() {
        InMemoryUserDetailsManager userDetailsManager = new InMemoryUserDetailsManager();
        userDetailsManager.createUser(User.builder().username("root").password("{noop}123").authorities("admin").build());
        return userDetailsManager;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService());
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

	// 使用默認(rèn)的 SessionRegistryImpl 實(shí)現(xiàn)類作為 Bean 類型即可
    @Bean
    public SessionRegistry sessionRegistry() {
        return new SessionRegistryImpl();
    }
    
	@Bean
    public LoginFilter loginFilter() throws Exception {
        LoginFilter loginFilter = new LoginFilter();
        loginFilter.setFilterProcessesUrl("/login");
        loginFilter.setAuthenticationManager(authenticationManagerBean());
        loginFilter.setAuthenticationSuccessHandler((request, response, authentication) -> {
            response.setStatus(200);
            response.setContentType("application/json;charset=UTF-8");
            response.getWriter().println("登錄成功！");
        });
        loginFilter.setAuthenticationFailureHandler((request, response, exception) -> {
            response.setStatus(500);
            response.setContentType("application/json;charset=UTF-8");
            response.getWriter().println("登錄失??！");
            response.getWriter().println(exception.getMessage());
            response.getWriter().flush();
        });
        // ???????????????????????????????????????
        // 為自定義的認(rèn)證過(guò)濾器封裝 SessionAuthenticationStrategy。需要兩個(gè) Strategy 組合使用才能發(fā)揮作用
        // ConcurrentSessionControlAuthenticationStrategy -》 控制并發(fā)數(shù)，讓超出的并發(fā)會(huì)話過(guò)期【ConcurrentSessionFilter 會(huì)在過(guò)期會(huì)話再次請(qǐng)求資源時(shí)，將過(guò)期會(huì)話進(jìn)行 logout 操作并重定向到登錄頁(yè)面】
        // RegisterSessionAuthenticationStrategy -》注冊(cè)新會(huì)話進(jìn) SessionRegistry 實(shí)例中
        ConcurrentSessionControlAuthenticationStrategy strategy1 = new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry());
        RegisterSessionAuthenticationStrategy strategy2 = new RegisterSessionAuthenticationStrategy(sessionRegistry());
        CompositeSessionAuthenticationStrategy compositeStrategy = new CompositeSessionAuthenticationStrategy(Arrays.asList(strategy1, strategy2));
        loginFilter.setSessionAuthenticationStrategy(compositeStrategy);
        return loginFilter;
    }
   
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

	// .......
	// 省略第3步中已經(jīng)貼出來(lái)的配置代碼
	
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests().anyRequest().authenticated()
                .and().csrf().disable()
                .exceptionHandling().authenticationEntryPoint((request, response, authException) -> {
                    response.setStatus(401);
                    response.setContentType("application/json;charset=UTF-8");
                    response.getWriter().println("未認(rèn)證，請(qǐng)登錄！");
                    response.getWriter().flush();
                })
                // 開(kāi)啟會(huì)話管理，設(shè)置會(huì)話最大并發(fā)數(shù)為 1
                .and().sessionManagement().maximumSessions(1)
                // 控制的是 ConcurrentSessionFilter 的 this.sessionInformationExpiredStrategy 屬性的實(shí)例化賦值對(duì)象
                .expiredSessionStrategy(event -> {
                    HttpServletResponse response = event.getResponse();
                    response.setContentType("application/json;charset=UTF-8");
                    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                    Map<String, String> result = new HashMap<>();
                    result.put("msg", "當(dāng)前用戶已在其他設(shè)備登錄，請(qǐng)重新登錄！");
                    response.getWriter().println(new ObjectMapper().writeValueAsString(result));
                })
        ;
        http.addFilterAt(loginFilter(), UsernamePasswordAuthenticationFilter.class);
    }
}