Spring Boot实战：Cookie与Session全解析
无状态HTTP的“记忆”方案：Spring Boot中Cookie&Session全栈实战
Cookie与Session的核心原理
HTTP协议无状态特性要求通过额外机制维持用户状态。Cookie是客户端存储的小型文本数据，Session是服务端存储的用户会话数据。Cookie通过Set-Cookie响应头传递，Session依赖唯一标识符（通常存储在Cookie中）关联服务端数据。
Spring Boot中Cookie操作实战
在Controller中直接操作HttpServletResponse添加Cookie：
@GetMapping("/set-cookie")
public String setCookie(HttpServletResponse response) {
Cookie cookie = new Cookie("user_token", "abc123");
cookie.setMaxAge(3600); // 1小时有效期
cookie.setPath("/");
response.addCookie(cookie);
return "Cookie set";
}
读取Cookie通过@CookieValue注解或HttpServletRequest：
@GetMapping("/read-cookie")
public String readCookie(@CookieValue(name = "user_token", defaultValue = "") String token) {
return "Cookie value: " + token;
}
Session管理实现方案
Spring Session提供自动化的Session管理，配置Redis作为存储后端：
spring:
session:
store-type: redis
redis:
host: localhost
port: 6379
通过@SessionAttribute访问会话数据：
@PostMapping("/login")
public String login(HttpSession session, @RequestParam String username) {
session.setAttribute("currentUser", username);
return "redirect:/dashboard";
}
@GetMapping("/dashboard")
public String dashboard(@SessionAttribute String currentUser) {
return "Welcome " + currentUser;
}
安全增强策略
强制HTTPS传输确保安全：
@Bean
public ServletWebServerFactory servletContainer() {
TomcatServletWebServerFactory factory = new TomcatServletWebServerFactory();
factory.addContextCustomizer(context -> {
context.setUseHttpOnly(true);
context.setSecure(true);
});
return factory;
}
防御会话固定攻击需在登录时重建Session：
session.invalidate();
session = request.getSession(true);
分布式环境解决方案
Spring Session配合Redis实现跨节点共享：
@Configuration
@EnableRedisHttpSession
public class SessionConfig extends AbstractHttpSessionApplicationInitializer {
@Bean
public LettuceConnectionFactory connectionFactory() {
return new LettuceConnectionFactory();
}
}
自定义Session ID解析器处理REST API场景：
public class HeaderSessionIdResolver implements HttpSessionIdResolver {
@Override
public List<String> resolveSessionIds(HttpServletRequest request) {
return Collections.list(request.getHeaders("X-Auth-Token"));
}
}
性能优化技巧
采用JWT替代传统Session减少服务端存储压力：
public String generateToken(User user) {
return Jwts.builder()
.setSubject(user.getId())
.setExpiration(new Date(System.currentTimeMillis() + 86400000))
.signWith(SignatureAlgorithm.HS512, "secret")
.compact();
}
Cookie分片策略处理大小限制：
IntStream.range(0, 3).forEach(i -> {
Cookie fragment = new Cookie("session_" + i, token.substring(i*100, Math.min((i+1)*100, token.length())));
response.addCookie(fragment);
});
浏览器端配合方案
JavaScript读取Cookie的现代API：
document.cookie = "user_token=abc123; max-age=3600; path=/; secure";
Service Worker中拦截请求注入凭证：
self.addEventListener('fetch', event => {
event.respondWith(
fetch(event.request, {
credentials: 'include'
})
);
});
监控与调试手段
Actuator端点暴露Session指标：
management:
endpoints:
web:
exposure:
include: sessions,metrics
分布式追踪整合SessionID：
@Bean
public CurrentTraceContext.ScopeDecorator mdcScopeDecorator() {
return MDCScopeDecorator.newBuilder()
.add(SessionIdFilter.SESSION_ID_MDC_KEY)
.build();
}
BbS.okacop020.info/PoSt/1120_847363.HtM
BbS.okacop021.info/PoSt/1120_634472.HtM
BbS.okacop022.info/PoSt/1120_643230.HtM
BbS.okacop023.info/PoSt/1120_331952.HtM
BbS.okacop024.info/PoSt/1120_483338.HtM
BbS.okacop025.info/PoSt/1120_562770.HtM
BbS.okacop026.info/PoSt/1120_039737.HtM
BbS.okacop027.info/PoSt/1120_499318.HtM
BbS.okacop028.info/PoSt/1120_854315.HtM
BbS.okacop029.info/PoSt/1120_909473.HtM
BbS.okacop020.info/PoSt/1120_868201.HtM
BbS.okacop021.info/PoSt/1120_055779.HtM
BbS.okacop022.info/PoSt/1120_981708.HtM
BbS.okacop023.info/PoSt/1120_816653.HtM
BbS.okacop024.info/PoSt/1120_940257.HtM
BbS.okacop025.info/PoSt/1120_049463.HtM
BbS.okacop026.info/PoSt/1120_560681.HtM
BbS.okacop027.info/PoSt/1120_012078.HtM
BbS.okacop028.info/PoSt/1120_017523.HtM
BbS.okacop029.info/PoSt/1120_939726.HtM
BbS.okacop020.info/PoSt/1120_181653.HtM
BbS.okacop021.info/PoSt/1120_957955.HtM
BbS.okacop022.info/PoSt/1120_801611.HtM
BbS.okacop023.info/PoSt/1120_660343.HtM
BbS.okacop024.info/PoSt/1120_223504.HtM
BbS.okacop025.info/PoSt/1120_881408.HtM
BbS.okacop026.info/PoSt/1120_049003.HtM
BbS.okacop027.info/PoSt/1120_320380.HtM
BbS.okacop028.info/PoSt/1120_393677.HtM
BbS.okacop029.info/PoSt/1120_465389.HtM
BbS.okacop020.info/PoSt/1120_856383.HtM
BbS.okacop021.info/PoSt/1120_501129.HtM
BbS.okacop022.info/PoSt/1120_104613.HtM
BbS.okacop023.info/PoSt/1120_004903.HtM
BbS.okacop024.info/PoSt/1120_660058.HtM
BbS.okacop025.info/PoSt/1120_848145.HtM
BbS.okacop026.info/PoSt/1120_756762.HtM
BbS.okacop027.info/PoSt/1120_849991.HtM
BbS.okacop028.info/PoSt/1120_151904.HtM
BbS.okacop029.info/PoSt/1120_718489.HtM
BbS.okacop020.info/PoSt/1120_968391.HtM
BbS.okacop021.info/PoSt/1120_061739.HtM
BbS.okacop022.info/PoSt/1120_585507.HtM
BbS.okacop023.info/PoSt/1120_059364.HtM
BbS.okacop024.info/PoSt/1120_630657.HtM
BbS.okacop025.info/PoSt/1120_471418.HtM
BbS.okacop026.info/PoSt/1120_334714.HtM
BbS.okacop027.info/PoSt/1120_649217.HtM
BbS.okacop028.info/PoSt/1120_202149.HtM
BbS.okacop029.info/PoSt/1120_358573.HtM
BbS.okacop020.info/PoSt/1120_889543.HtM
BbS.okacop021.info/PoSt/1120_193750.HtM
BbS.okacop022.info/PoSt/1120_891511.HtM
BbS.okacop023.info/PoSt/1120_600012.HtM
BbS.okacop024.info/PoSt/1120_985056.HtM
BbS.okacop025.info/PoSt/1120_407684.HtM
BbS.okacop026.info/PoSt/1120_371070.HtM
BbS.okacop027.info/PoSt/1120_893982.HtM
BbS.okacop028.info/PoSt/1120_937600.HtM
BbS.okacop029.info/PoSt/1120_401301.HtM
BbS.okacop020.info/PoSt/1120_121728.HtM
BbS.okacop021.info/PoSt/1120_967752.HtM
BbS.okacop022.info/PoSt/1120_885554.HtM
BbS.okacop023.info/PoSt/1120_759828.HtM
BbS.okacop024.info/PoSt/1120_571755.HtM
BbS.okacop025.info/PoSt/1120_508258.HtM
BbS.okacop026.info/PoSt/1120_027997.HtM
BbS.okacop027.info/PoSt/1120_592112.HtM
BbS.okacop028.info/PoSt/1120_185944.HtM
BbS.okacop029.info/PoSt/1120_037847.HtM
BbS.okacop030.info/PoSt/1120_444549.HtM
BbS.okacop031.info/PoSt/1120_840963.HtM
BbS.okacop032.info/PoSt/1120_965321.HtM
BbS.okacop033.info/PoSt/1120_849801.HtM
BbS.okacop034.info/PoSt/1120_460906.HtM
BbS.okacop035.info/PoSt/1120_401418.HtM
BbS.okacop036.info/PoSt/1120_172669.HtM
BbS.okacop037.info/PoSt/1120_414507.HtM
BbS.okacop038.info/PoSt/1120_150463.HtM
BbS.okacop039.info/PoSt/1120_404564.HtM
