07 会话技术

Cookie: key1=value1; key2=value2

GET http://localhost:8083/demo1/cookie/fetch HTTP/1.1
Host: localhost:8083
Connection: keep-alive
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="110", "Not A(Brand";v="24", "Microsoft Edge";v="110"
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: zhangsan=123456; lisi=654321

GET http://localhost:8083/demo1/cookie/fetch HTTP/1.1
Cookie: zhaoliu=123456; wangwu=789987
User-Agent: PostmanRuntime/7.29.2
Accept: */*
Host: localhost:8083
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

/**
 * 设置 Cookie
 * 访问：http://localhost:8083/demo1/cookie/set?username=lilei
 * 
 * @author stone
 * @date 2023/02/17
 */
@WebServlet("/cookie/set")
public class CookieSetServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) 
            throws ServletException, IOException {
        String username = req.getParameter("username");

        // 方式1：通过响应头设置（原始方式）
        resp.setHeader("Set-Cookie", "username=" + username);
        
        // 方式2：使用 Cookie 对象（推荐方式）
        // Cookie cookie = new Cookie("username", username);
        // resp.addCookie(cookie);
    }
}

HTTP/1.1 200
Set-Cookie: username=lilei
Content-Length: 0
Date: Fri, 17 Feb 2023 08:15:48 GMT
Keep-Alive: timeout=20
Connection: keep-alive

Cookie cookie = new Cookie("username", username);
resp.addCookie(cookie);

@WebServlet("/cookie/fetch")
public class CookieFetchServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse resp) 
            throws ServletException, IOException {
        // 获取所有 Cookie
        Cookie[] cookies = request.getCookies();
        
        if (cookies != null) {
            for (Cookie cookie : cookies) {
                String name = cookie.getName();
                String value = cookie.getValue();
                System.out.println(name + " -> " + value);
            }
        }
    }
}

/**
 * 获取指定名称的 Cookie 值
 */
private String getCookieValue(HttpServletRequest request, String cookieName) {
    Cookie[] cookies = request.getCookies();
    if (cookies != null) {
        for (Cookie cookie : cookies) {
            if (cookieName.equals(cookie.getName())) {
                return cookie.getValue();
            }
        }
    }
    return null;
}

@WebServlet("/cookie/path-demo")
public class PathDemoServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) 
            throws ServletException, IOException {
        
        // 方式1：使用当前请求的默认路径
        Cookie cookie1 = new Cookie("user1", "zhangsan");
        // 默认路径为 /demo1/cookie
        resp.addCookie(cookie1);
        
        // 方式2：手动指定路径
        Cookie cookie2 = new Cookie("user2", "lisi");
        cookie2.setPath("/demo1");  // 整个 /demo1 应用都可访问
        resp.addCookie(cookie2);
        
        // 方式3：根路径
        Cookie cookie3 = new Cookie("user3", "wangwu");
        cookie3.setPath("/");  // 整个域名下都可访问
        resp.addCookie(cookie3);
    }
}

@WebServlet("/cookie/domain-demo")
public class DomainDemoServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) 
            throws ServletException, IOException {
        Cookie cookie = new Cookie("shared_data", "test_value");
        
        // 设置父域名，子域名可共享此 Cookie
        cookie.setDomain(".example.com");
        cookie.setPath("/");
        
        resp.addCookie(cookie);
    }
}

@WebServlet("/cookie/maxage-demo")
public class MaxAgeDemoServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) 
            throws ServletException, IOException {
        
        // 1. 会话级别 Cookie（浏览器关闭即失效）
        Cookie sessionCookie = new Cookie("temp", "value");
        resp.addCookie(sessionCookie);
        
        // 2. 持久化 Cookie（7天有效）
        Cookie persistentCookie = new Cookie("remember", "token123");
        persistentCookie.setMaxAge(7 * 24 * 60 * 60); // 7天
        resp.addCookie(persistentCookie);
        
        // 3. 删除 Cookie
        Cookie cookieToDelete = new Cookie("username", "");
        cookieToDelete.setMaxAge(0);
        cookieToDelete.setPath("/demo1"); // 注意：路径要与原 Cookie 一致
        resp.addCookie(cookieToDelete);
    }
}

Cookie cookie = new Cookie("session_token", "secret_value");
cookie.setHttpOnly(true);  // JavaScript 无法读取
resp.addCookie(cookie);

// 如果没有 HttpOnly，恶意脚本可以窃取 Cookie
document.cookie; // 获取所有 Cookie

Cookie cookie = new Cookie("sensitive_data", "value");
cookie.setSecure(true);  // 仅 HTTPS 传输
resp.addCookie(cookie);

// Tomcat 8.5+ 支持 SameSite
// 需要通过 Set-Cookie 头手动设置
resp.setHeader("Set-Cookie", "name=value; SameSite=Strict");

@WebServlet("/cookie/last-visit")
public class LastVisitServlet extends HttpServlet {

    private static final String COOKIE_NAME = "lastVisit";
    private static final String DATE_FORMAT = "yyyy-MM-dd HH:mm:ss";
    private static final String CHARSET = "UTF-8";

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) 
            throws ServletException, IOException {
        
        req.setCharacterEncoding(CHARSET);
        resp.setContentType("text/html;charset=" + CHARSET);
        
        PrintWriter out = resp.getWriter();
        
        // 1. 读取上次访问时间
        String lastVisit = getCookieValue(req, COOKIE_NAME);
        
        if (lastVisit != null) {
            // 解码并显示上次访问时间
            String decodedTime = URLDecoder.decode(lastVisit, CHARSET);
            out.println("<h2>欢迎回来！</h2>");
            out.println("<p>您上次访问时间是：" + decodedTime + "</p>");
        } else {
            out.println("<h2>欢迎首次访问！</h2>");
        }
        
        // 2. 更新访问时间
        String currentTime = new SimpleDateFormat(DATE_FORMAT).format(new Date());
        // URL 编码：处理空格等特殊字符
        String encodedTime = URLEncoder.encode(currentTime, CHARSET);
        
        Cookie cookie = new Cookie(COOKIE_NAME, encodedTime);
        cookie.setMaxAge(30 * 24 * 60 * 60); // 30天有效期
        resp.addCookie(cookie);
    }
    
    private String getCookieValue(HttpServletRequest request, String name) {
        Cookie[] cookies = request.getCookies();
        if (cookies != null) {
            for (Cookie cookie : cookies) {
                if (name.equals(cookie.getName())) {
                    return cookie.getValue();
                }
            }
        }
        return null;
    }
}

// 存储时编码
String encoded = URLEncoder.encode("张三", "UTF-8");
Cookie cookie = new Cookie("name", encoded);

// 读取时解码
String decoded = URLDecoder.decode(cookie.getValue(), "UTF-8");

Cookie cookie = new Cookie("name", "");  // 值为空
cookie.setMaxAge(0);                      // 立即过期
cookie.setPath("/demo1");                // 路径必须与原 Cookie 一致
cookie.setDomain(".example.com");        // 域名必须与原 Cookie 一致
resp.addCookie(cookie);

HTTP/1.1 200
Set-Cookie: JSESSIONID=F1500D1D295B3953DCBBF89AD614F1E6; Path=/demo2; HttpOnly
Content-Length: 0
Date: Mon, 20 Feb 2023 06:55:17 GMT

GET http://localhost:8083/demo2/hello HTTP/1.1
Host: localhost:8083
Cookie: JSESSIONID=F1500D1D295B3953DCBBF89AD614F1E6

// 方式1：常用方式
// 如果不存在则创建，如果存在则返回已有 Session
HttpSession session = request.getSession();

// 方式2：带参数方式
// true：同方式1
// false：不存在则返回 null，不创建新 Session
HttpSession session = request.getSession(false);

@WebServlet("/session/set")
public class SessionSetServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) 
            throws ServletException, IOException {
        
        // 获取 Session（不存在则创建）
        HttpSession session = req.getSession();
        
        // 存储数据
        session.setAttribute("mobile", "18666778899");
        session.setAttribute("userId", 65536);
        session.setAttribute("user", new User("zhangsan", 20));
    }
}

@WebServlet("/session/get")
public class SessionGetServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) 
            throws ServletException, IOException {
        
        resp.setContentType("text/html;charset=UTF-8");
        PrintWriter out = resp.getWriter();
        
        HttpSession session = req.getSession();
        
        // 获取数据
        String mobile = (String) session.getAttribute("mobile");
        Integer userId = (Integer) session.getAttribute("userId");
        User user = (User) session.getAttribute("user");
        
        out.println("UserId: " + userId + "<br>");
        out.println("Mobile: " + mobile + "<br>");
        out.println("User: " + user + "<br>");
    }
}

// 移除单个属性
session.removeAttribute("mobile");

// 清空所有数据
session.invalidate();  // 同时使 Session 失效

// 设置 Session 有效期（秒）
session.setMaxInactiveInterval(30 * 60);  // 30分钟

// 获取创建时间
long createTime = session.getCreationTime();

// 获取最后访问时间
long lastAccessTime = session.getLastAccessedTime();

@WebServlet("/user/login")
public class LoginServlet extends HttpServlet {

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) 
            throws ServletException, IOException {
        
        req.setCharacterEncoding("UTF-8");
        resp.setContentType("application/json;charset=UTF-8");
        
        String username = req.getParameter("username");
        String password = req.getParameter("password");
        
        // 验证用户（简化示例，实际应查询数据库）
        if ("admin".equals(username) && "123456".equals(password)) {
            // 登录成功，存储用户信息到 Session
            HttpSession session = req.getSession();
            session.setAttribute("currentUser", username);
            session.setAttribute("loginTime", new Date());
            
            resp.getWriter().write("{\"code\":200,\"msg\":\"登录成功\"}");
        } else {
            resp.getWriter().write("{\"code\":401,\"msg\":\"用户名或密码错误\"}");
        }
    }
}

@WebFilter("/protected/*")
public class AuthFilter implements Filter {
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                         FilterChain chain) throws IOException, ServletException {
        
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse resp = (HttpServletResponse) response;
        
        HttpSession session = req.getSession(false);
        
        // 检查是否已登录
        if (session == null || session.getAttribute("currentUser") == null) {
            resp.setStatus(401);
            resp.getWriter().write("请先登录");
            return;
        }
        
        // 已登录，继续访问
        chain.doFilter(request, response);
    }
}

@WebServlet("/protected/profile")
public class ProfileServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) 
            throws ServletException, IOException {
        
        resp.setContentType("text/html;charset=UTF-8");
        HttpSession session = req.getSession();
        
        String user = (String) session.getAttribute("currentUser");
        Date loginTime = (Date) session.getAttribute("loginTime");
        
        resp.getWriter().println("<h2>个人中心</h2>");
        resp.getWriter().println("<p>当前用户：" + user + "</p>");
        resp.getWriter().println("<p>登录时间：" + loginTime + "</p>");
    }
}

@WebServlet("/user/logout")
public class LogoutServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) 
            throws ServletException, IOException {
        
        HttpSession session = req.getSession(false);
        if (session != null) {
            session.invalidate();  // 使 Session 失效
        }
        
        resp.sendRedirect("/login.html");
    }
}

// 记录下 JSESSIONID
HttpSession session = req.getSession();
System.out.println("Session ID: " + session.getId());

// 关闭浏览器后，手动在请求中携带之前的 JSESSIONID
// 仍然可以获取到原来的 Session 数据

// 自动在 URL 后追加 JSESSIONID
String url = resp.encodeURL("/demo2/session/get");
// 结果：/demo2/session/get;JSESSIONID=aaaabc2849ea

resp.sendRedirect(url);

// 方案1：允许同时登录（默认行为）
// 每个浏览器获得不同的 Session

// 方案2：限制同时登录（踢掉之前的）
// 需要配合应用层缓存实现

@WebServlet("/user/login-with-remember")
public class LoginWithRememberServlet extends HttpServlet {

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) 
            throws ServletException, IOException {
        
        String username = req.getParameter("username");
        String password = req.getParameter("password");
        String remember = req.getParameter("remember"); // "on" 表示勾选
        
        if (validateUser(username, password)) {
            // 1. 创建 Session（用于本次会话）
            HttpSession session = req.getSession();
            session.setAttribute("user", username);
            
            // 2. 如果勾选"记住我"，写入长期 Cookie
            if ("on".equals(remember)) {
                Cookie rememberCookie = new Cookie("remember_token", 
                    generateToken(username));
                rememberCookie.setMaxAge(7 * 24 * 60 * 60); // 7天
                rememberCookie.setHttpOnly(true);
                rememberCookie.setSecure(true);
                rememberCookie.setPath("/");
                resp.addCookie(rememberCookie);
            }
            
            resp.sendRedirect("/home.html");
        } else {
            resp.sendRedirect("/login.html?error=1");
        }
    }
    
    private boolean validateUser(String username, String password) {
        // 实际应查询数据库验证
        return "admin".equals(username) && "123456".equals(password);
    }
    
    private String generateToken(String username) {
        // 实际应使用安全的 token 生成算法
        return username + "_" + System.currentTimeMillis();
    }
}

@WebFilter("/*")
public class AutoLoginFilter implements Filter {
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                         FilterChain chain) throws IOException, ServletException {
        
        HttpServletRequest req = (HttpServletRequest) request;
        HttpSession session = req.getSession(false);
        
        // 已有 Session，无需处理
        if (session != null && session.getAttribute("user") != null) {
            chain.doFilter(request, response);
            return;
        }
        
        // 检查 remember Cookie
        Cookie[] cookies = req.getCookies();
        if (cookies != null) {
            for (Cookie cookie : cookies) {
                if ("remember_token".equals(cookie.getName())) {
                    String token = cookie.getValue();
                    String username = validateToken(token);
                    
                    if (username != null) {
                        // Token 有效，自动创建 Session
                        session = req.getSession();
                        session.setAttribute("user", username);
                    }
                    break;
                }
            }
        }
        
        chain.doFilter(request, response);
    }
    
    private String validateToken(String token) {
        // 实际应验证 token 的有效性
        if (token != null && token.startsWith("admin_")) {
            return "admin";
        }
        return null;
    }
}

// Request 域：一次请求有效
req.setAttribute("error", "用户名错误");
req.getRequestDispatcher("/error.jsp").forward(req, resp);

// Session 域：用户会话有效
session.setAttribute("user", user);

// Context 域：应用全局有效
getServletContext().setAttribute("appConfig", config);

Cookie cookie = new Cookie("token", value);

// 1. HttpOnly：防止 XSS 窃取
cookie.setHttpOnly(true);

// 2. Secure：仅 HTTPS 传输
cookie.setSecure(true);

// 3. SameSite：防止 CSRF
cookie.setPath("/");
// 注意：Java Cookie API 不直接支持 SameSite，需手动设置 Header
resp.setHeader("Set-Cookie", 
    "token=" + value + "; HttpOnly; Secure; SameSite=Strict");

// ❌ 错误：直接在 Cookie 中存储明文密码
Cookie badCookie = new Cookie("password", "123456");

// ✅ 正确：只存储随机生成的 Token
Cookie goodCookie = new Cookie("session_token", 
    UUID.randomUUID().toString());
goodCookie.setHttpOnly(true);
goodCookie.setSecure(true);

// 存储时编码
Cookie cookie = new Cookie("name", 
    URLEncoder.encode("张三", "UTF-8"));

// 读取时解码
String name = URLDecoder.decode(cookie.getValue(), "UTF-8");