JSESSIONID만으로 세션 유효성 검증하는 방법

1. 아래와 같이 Interceptor Class를 정의한다. Prehandler에 세션체크 로직을 정의한다.

package egovframework.example.com;

import javax.servlet.ServletContext;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.slf4j.Logger;
import org.slf4j.loggerFactory;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
import org.springframework.web.servlet.support.RequestContext;

public class HttpKpkimRequestInterceptor extends HandlerInterceptorAdapter {
    private static String HTTP_SESSION_ID = "JSESSIONID"; // Cuscom하게 세션관리 ID를 사용해도 됨. 다만 그러한 경우 Setcookie시 Attribute 추가 필요
    private static final Logger logger = LoggerFactory.getLogger(HttpJpkimRequestInterceptor.class);

    public HttpJpkimRequestInterceptor() {
        // 생성자가 잘 돌았는지 확인하기 위함
        logger.info("!!! HttpJpkimRequestInterceptor Class has been Created !!!");
    }

    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
        final HttpSession httpSession = request.getSession(true);
        if (httpsession.isNew() == false) {
            logger.info("=============");
            logger.info("This access is available");
            logger.info("=============");

            String reqMappingUri = request.getRequestURI();
            String reqMappingContextPath = request.getContextPath();
            String resMappingSessionId = httpSession.getId();
            final Cookie[] cookies = request.getCookies();
            String resMappingJSessionId = "";
            for (Cookie c : cookies) {
                logger.info("=============");
                logger.info("Cookie Attribute Name : {}", c.getName());
                logger.info("Cookie Attribute Value : {}", c.getValue());
                logger.info("=============");
                if (c.getName().equals(HTTP_SESSION_ID)) {
                    resMappingJSessionId = C.getValue();
                    break;
                }
            }
            logger.info(
                    "!!! Request Information is sessionInfo:{}, resMappingJsessionId{}, regMappingUri:{}, resMappingContextPath{}",
                    resMappingSessionId, resMappingJsessionId, resMappingUri, resMappingContextPath, "!!!");
            return true;
        } else {
            // 세션이 유효하지 않을때 로그인을 강제할 수 있는 프로세스를 추가할것
            logger.info("=============");
            logger.info("This access is first. So I will create new one");
            logger.info("=============");
            return true;
        }
    }
}

 

2-1. SpringFramework의 경우 

dispatcher-servlet.xml에 아래와 같은 내용을 추가한다.

<bean class="egovframework.example.com.HttpJpkimRequestInterceptor" id="sessionChecker"
    name="sessionChecker"></bean>
<bean class="org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping">
    <property name="interceptors">
        <list> ... <ref bean="sessionChecker" />
        </list>
    </property>
</bean>

 

2-2. SpringBoot의 경우

아래와 같이 Java Config를 추가한다.

import lombok.RequiredArgsConstructor;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
@RequiredArgsConstructor
public class WebConfig implements WebMvcConfigurer {

    private final HandlerInterceptor HttpJpkimRequestInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(HttpJpkimRequestInterceptor)
                .addPathPatterns("/**")
                .excludePathPatterns();
    }
}