@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests().anyRequest().authenticated()
                .and().formLogin()
//                .and().sessionManagement().maximumSessions(1)
//                .and()
                .and().csrf().disable()
                // 開啟 session 管理
                .sessionManagement()
                // 設(shè)置同一用戶在同一時刻允許的 session 最大并發(fā)數(shù)
                .maximumSessions(1)
                // 過期會話【即被踢出的舊會話】的跳轉(zhuǎn)路徑
                .expiredUrl("/login")
        ;
    }
    
}

public abstract class AbstractAuthenticationProcessingFilter extends GenericFilterBean
		implements ApplicationEventPublisherAware, MessageSourceAware {
		
	private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
			throws IOException, ServletException {
		if (!requiresAuthentication(request, response)) {
			chain.doFilter(request, response);
			return;
		}
		try {
			// 調(diào)用具體的子類實現(xiàn)的 attemptAuthentication 方法，嘗試進行認證
			Authentication authenticationResult = attemptAuthentication(request, response);
			if (authenticationResult == null) {
				// return immediately as subclass has indicated that it hasn't completed
				return;
			}
			
			//【????】根據(jù)配置的 session 管理策略，對 session 進行管理
			this.sessionStrategy.onAuthentication(authenticationResult, request, response);
			// Authentication success
			if (this.continueChainBeforeSuccessfulAuthentication) {
				chain.doFilter(request, response);
			}
			// 認證成功后的處理，主要是包含兩方面：
			// 1、rememberMe 功能的業(yè)務(wù)邏輯
			// 2、登錄成功的 handler 回調(diào)處理
			successfulAuthentication(request, response, chain, authenticationResult);
		}
		catch (InternalAuthenticationServiceException failed) {
			this.logger.error("An internal error occurred while trying to authenticate the user.", failed);
			unsuccessfulAuthentication(request, response, failed);
		}
		catch (AuthenticationException ex) {
			// Authentication failed
			unsuccessfulAuthentication(request, response, ex);
		}
	}

}

	@Override
	public void onAuthentication(Authentication authentication, HttpServletRequest request,
			HttpServletResponse response) throws SessionAuthenticationException {
		int currentPosition = 0;
		int size = this.delegateStrategies.size();
		for (SessionAuthenticationStrategy delegate : this.delegateStrategies) {
			if (this.logger.isTraceEnabled()) {
				this.logger.trace(LogMessage.format("Preparing session with %s (%d/%d)",
						delegate.getClass().getSimpleName(), ++currentPosition, size));
			}
			// 依次調(diào)用內(nèi)部的每一個 Strategy 的 onAuthentication()
			delegate.onAuthentication(authentication, request, response);
		}
	}

public class ConcurrentSessionControlAuthenticationStrategy
		implements MessageSourceAware, SessionAuthenticationStrategy {

	protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();

	private final SessionRegistry sessionRegistry;

	private boolean exceptionIfMaximumExceeded = false;

	private int maximumSessions = 1;

	// 從構(gòu)造器可以看出，該策略的實例【強依賴】于 SessionRegistry，因此，如果我們自己創(chuàng)建該策略實例，就得先擁有 SessionRegistry 實例
	public ConcurrentSessionControlAuthenticationStrategy(SessionRegistry sessionRegistry) {
		Assert.notNull(sessionRegistry, "The sessionRegistry cannot be null");
		this.sessionRegistry = sessionRegistry;
	}


	@Override
	public void onAuthentication(Authentication authentication, HttpServletRequest request,
			HttpServletResponse response) {
		// 獲取配置的每一個用戶同一時刻允許最多登錄的端數(shù)，即并發(fā)會話的個數(shù)，也就是我們在配置類中配置的 maximumSessions() 
		int allowedSessions = getMaximumSessionsForThisUser(authentication);
		if (allowedSessions == -1) {
			// We permit unlimited logins
			return;
		}
		// 從 sessionRegistry 中根據(jù)本次認證的用戶信息，來獲取它關(guān)聯(lián)的所有 sessionid 集合
		// ?? 注意：由于比較的時候是去調(diào)用 key 對象的 hashcode()，因此如果是自己實現(xiàn)了 UserDetails 實例用于封裝用戶信息，必須要重寫 hashcode()
		List<SessionInformation> sessions = this.sessionRegistry.getAllSessions(authentication.getPrincipal(), false);
		int sessionCount = sessions.size();
		// 還沒有達到并發(fā)會話的最大限制數(shù)，就直接 return 了
		if (sessionCount < allowedSessions) {
			// They haven't got too many login sessions running at present
			return;
		}
		// 如果當前已有的最大會話數(shù)已經(jīng)達到了限制的并發(fā)會話數(shù)，就判斷本次請求的會話的id，是否已經(jīng)囊括在已有的會話id集合中了，如果包含在其中，也不進行后續(xù)的業(yè)務(wù)處理了，直接 return
		if (sessionCount == allowedSessions) {
			HttpSession session = request.getSession(false);
			if (session != null) {
				// Only permit it though if this request is associated with one of the
				// already registered sessions
				for (SessionInformation si : sessions) {
					if (si.getSessionId().equals(session.getId())) {
						return;
					}
				}
			}
			// If the session is null, a new one will be created by the parent class,
			// exceeding the allowed number
		}
		//【??】：如果當前用戶所關(guān)聯(lián)的會話已經(jīng)達到了并發(fā)會話管理的限制個數(shù)，并且本次的會話不再已有的會話集合中，即本次的會話是一個新創(chuàng)建的會話，那么就會走下面的方法
		// 該方法主要是計算需要踢出多少個該用戶的舊會話來為新會話騰出空間，所謂的踢出，只是將一定數(shù)量的舊會話進行標識為“已過期”，真正進行踢出動作的不是策略本身
		allowableSessionsExceeded(sessions, allowedSessions, this.sessionRegistry);
	}

	protected int getMaximumSessionsForThisUser(Authentication authentication) {
		return this.maximumSessions;
	}

	protected void allowableSessionsExceeded(List<SessionInformation> sessions, int allowableSessions,
			SessionRegistry registry) throws SessionAuthenticationException {
		if (this.exceptionIfMaximumExceeded || (sessions == null)) {
			throw new SessionAuthenticationException(
					this.messages.getMessage("ConcurrentSessionControlAuthenticationStrategy.exceededAllowed",
							new Object[] { allowableSessions }, "Maximum sessions of {0} for this principal exceeded"));
		}
		// Determine least recently used sessions, and mark them for invalidation
		// 根據(jù)會話的最新一次活動時間來排序
		sessions.sort(Comparator.comparing(SessionInformation::getLastRequest));
		// 當前已有的會話數(shù) + 1【本次新創(chuàng)建的會話】- 限制的最大會話并發(fā)數(shù) = 需要踢出的舊會話個數(shù)
		int maximumSessionsExceededBy = sessions.size() - allowableSessions + 1;
		List<SessionInformation> sessionsToBeExpired = sessions.subList(0, maximumSessionsExceededBy);
		for (SessionInformation session : sessionsToBeExpired) {
			// 將 會話 的過期標識設(shè)置為 true
			session.expireNow();
		}
	}

}

public class RegisterSessionAuthenticationStrategy implements SessionAuthenticationStrategy {

	private final SessionRegistry sessionRegistry;

	// 從構(gòu)造器可以看出，該策略的實例【強依賴】于 SessionRegistry，因此，如果我們自己創(chuàng)建該策略實例，就得先擁有 SessionRegistry 實例
	public RegisterSessionAuthenticationStrategy(SessionRegistry sessionRegistry) {
		Assert.notNull(sessionRegistry, "The sessionRegistry cannot be null");
		this.sessionRegistry = sessionRegistry;
	}

	@Override
	public void onAuthentication(Authentication authentication, HttpServletRequest request,
			HttpServletResponse response) {
		//負責(zé)將本次創(chuàng)建的新會話注冊進 sessionRegistry 中
		this.sessionRegistry.registerNewSession(request.getSession().getId(), authentication.getPrincipal());
	}

}

public interface SessionRegistry {
	List<Object> getAllPrincipals();
	List<SessionInformation> getAllSessions(Object principal, boolean includeExpiredSessions);
	SessionInformation getSessionInformation(String sessionId);
	void refreshLastRequest(String sessionId);
	void registerNewSession(String sessionId, Object principal);
	void removeSessionInformation(String sessionId);
}

public class SessionRegistryImpl implements SessionRegistry, ApplicationListener<AbstractSessionEvent> {

	protected final Log logger = LogFactory.getLog(SessionRegistryImpl.class);

	// <principal:Object,SessionIdSet>
	// 存儲了同一個用戶所關(guān)聯(lián)的所有 session 的 id 集合，以用戶實例對象的 hashcode() 返回值為 key
	private final ConcurrentMap<Object, Set<String>> principals;

	// <sessionId:Object,SessionInformation>
	// 存儲了每一個用戶會話的詳細信息，以 sessionId 為 key
	private final Map<String, SessionInformation> sessionIds;

	public SessionRegistryImpl() {
		this.principals = new ConcurrentHashMap<>();
		this.sessionIds = new ConcurrentHashMap<>();
	}

	public SessionRegistryImpl(ConcurrentMap<Object, Set<String>> principals,
			Map<String, SessionInformation> sessionIds) {
		this.principals = principals;
		this.sessionIds = sessionIds;
	}

	@Override
	public List<Object> getAllPrincipals() {
		return new ArrayList<>(this.principals.keySet());
	}

	// 根本 UserDetails 實例對象的 hashcode()，獲取到該用戶關(guān)聯(lián)到的所有的 Session
	@Override
	public List<SessionInformation> getAllSessions(Object principal, boolean includeExpiredSessions) {
		Set<String> sessionsUsedByPrincipal = this.principals.get(principal);
		if (sessionsUsedByPrincipal == null) {
			return Collections.emptyList();
		}
		List<SessionInformation> list = new ArrayList<>(sessionsUsedByPrincipal.size());
		for (String sessionId : sessionsUsedByPrincipal) {
			SessionInformation sessionInformation = getSessionInformation(sessionId);
			if (sessionInformation == null) {
				continue;
			}
			if (includeExpiredSessions || !sessionInformation.isExpired()) {
				list.add(sessionInformation);
			}
		}
		return list;
	}

	// 根據(jù) sessionId 獲取到具體的 Session 信息（其中包含了過期標識位）
	@Override
	public SessionInformation getSessionInformation(String sessionId) {
		Assert.hasText(sessionId, "SessionId required as per interface contract");
		return this.sessionIds.get(sessionId);
	}

	@Override
	public void onApplicationEvent(AbstractSessionEvent event) {
		if (event instanceof SessionDestroyedEvent) {
			SessionDestroyedEvent sessionDestroyedEvent = (SessionDestroyedEvent) event;
			String sessionId = sessionDestroyedEvent.getId();
			removeSessionInformation(sessionId);
		}
		else if (event instanceof SessionIdChangedEvent) {
			SessionIdChangedEvent sessionIdChangedEvent = (SessionIdChangedEvent) event;
			String oldSessionId = sessionIdChangedEvent.getOldSessionId();
			if (this.sessionIds.containsKey(oldSessionId)) {
				Object principal = this.sessionIds.get(oldSessionId).getPrincipal();
				removeSessionInformation(oldSessionId);
				registerNewSession(sessionIdChangedEvent.getNewSessionId(), principal);
			}
		}
	}

	// 刷新會話的最新活躍時間（用于標識過期邏輯中的排序）
	@Override
	public void refreshLastRequest(String sessionId) {
		Assert.hasText(sessionId, "SessionId required as per interface contract");
		SessionInformation info = getSessionInformation(sessionId);
		if (info != null) {
			info.refreshLastRequest();
		}
	}

	// 注冊新的用戶會話信息
	@Override
	public void registerNewSession(String sessionId, Object principal) {
		Assert.hasText(sessionId, "SessionId required as per interface contract");
		Assert.notNull(principal, "Principal required as per interface contract");
		if (getSessionInformation(sessionId) != null) {
			removeSessionInformation(sessionId);
		}
		if (this.logger.isDebugEnabled()) {
			this.logger.debug(LogMessage.format("Registering session %s, for principal %s", sessionId, principal));
		}
		this.sessionIds.put(sessionId, new SessionInformation(principal, sessionId, new Date()));
		this.principals.compute(principal, (key, sessionsUsedByPrincipal) -> {
			if (sessionsUsedByPrincipal == null) {
				sessionsUsedByPrincipal = new CopyOnWriteArraySet<>();
			}
			sessionsUsedByPrincipal.add(sessionId);
			this.logger.trace(LogMessage.format("Sessions used by '%s' : %s", principal, sessionsUsedByPrincipal));
			return sessionsUsedByPrincipal;
		});
	}

	// 移除過期的用戶會話信息
	@Override
	public void removeSessionInformation(String sessionId) {
		Assert.hasText(sessionId, "SessionId required as per interface contract");
		SessionInformation info = getSessionInformation(sessionId);
		if (info == null) {
			return;
		}
		if (this.logger.isTraceEnabled()) {
			this.logger.debug("Removing session " + sessionId + " from set of registered sessions");
		}
		this.sessionIds.remove(sessionId);
		this.principals.computeIfPresent(info.getPrincipal(), (key, sessionsUsedByPrincipal) -> {
			this.logger.debug(
					LogMessage.format("Removing session %s from principal's set of registered sessions", sessionId));
			sessionsUsedByPrincipal.remove(sessionId);
			if (sessionsUsedByPrincipal.isEmpty()) {
				// No need to keep object in principals Map anymore
				this.logger.debug(LogMessage.format("Removing principal %s from registry", info.getPrincipal()));
				sessionsUsedByPrincipal = null;
			}
			this.logger.trace(
					LogMessage.format("Sessions used by '%s' : %s", info.getPrincipal(), sessionsUsedByPrincipal));
			return sessionsUsedByPrincipal;
		});
	}

}

public class ConcurrentSessionFilter extends GenericFilterBean {

	private final SessionRegistry sessionRegistry;

	private String expiredUrl;

	private RedirectStrategy redirectStrategy;

	private LogoutHandler handlers = new CompositeLogoutHandler(new SecurityContextLogoutHandler());

	private SessionInformationExpiredStrategy sessionInformationExpiredStrategy;

	@Override
	public void afterPropertiesSet() {
		Assert.notNull(this.sessionRegistry, "SessionRegistry required");
	}

	// 過濾器嘛，最重要的就是這個方法啦
	@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
			throws IOException, ServletException {
		doFilter((HttpServletRequest) request, (HttpServletResponse) response, chain);
	}

	private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
			throws IOException, ServletException {
		// 獲取本次請求的 session
		HttpSession session = request.getSession(false);
		if (session != null) {
			// 判斷當前會話是否已經(jīng)注冊進了 sessionRegistry 數(shù)據(jù)中心
			SessionInformation info = this.sessionRegistry.getSessionInformation(session.getId());
			if (info != null) {
				// 如果已在 sessionRegistry，那么判斷下該 session 是否已經(jīng)過期了【通過前面提到的過期標識位來判斷】
				if (info.isExpired()) {
					// Expired - abort processing
					this.logger.debug(LogMessage
							.of(() -> "Requested session ID " + request.getRequestedSessionId() + " has expired."));
					// 對于已經(jīng)過期的會話，就不放行本次請求了，而是對本次會話進行 logout 處理，即注銷登錄處理【具體實現(xiàn)看下一個方法】
					doLogout(request, response);
					// 調(diào)用會話過期處理策略進行過期業(yè)務(wù)處理
					// 如果在自定義的配置類中有顯式聲明了SessionManagementConfigurer.expiredSessionStrategy() 配置，那么此處就會去回調(diào)我們聲明的策略實現(xiàn)
					this.sessionInformationExpiredStrategy
							.onExpiredSessionDetected(new SessionInformationExpiredEvent(info, request, response));
					return;
				}
				// Non-expired - update last request date/time
				// 如果會話沒有過期，就刷新該會話的最新活躍時間【用于淘汰過期會話時排序使用】
				this.sessionRegistry.refreshLastRequest(info.getSessionId());
			}
		}
		chain.doFilter(request, response);
	}

	private void doLogout(HttpServletRequest request, HttpServletResponse response) {
		Authentication auth = SecurityContextHolder.getContext().getAuthentication();
		// 執(zhí)行 logout 操作，包括移除會話、重定向到登錄請求、返回注銷成功的 json 數(shù)據(jù)等
		this.handlers.logout(request, response, auth);
	}

	// SessionInformationExpiredStrategy 的私有默認實現(xiàn)
	// 如果我們在自定義配置類中沒有指定 expiredSessionStrategy() 的具體配置，那么就會使用這個實現(xiàn)，這個實現(xiàn)不做任何業(yè)務(wù)邏輯處理，只負責(zé)打印響應(yīng)日志
	private static final class ResponseBodySessionInformationExpiredStrategy
			implements SessionInformationExpiredStrategy {

		@Override
		public void onExpiredSessionDetected(SessionInformationExpiredEvent event) throws IOException {
			HttpServletResponse response = event.getResponse();
			response.getWriter().print("This session has been expired (possibly due to multiple concurrent "
					+ "logins being attempted as the same user).");
			response.flushBuffer();
		}

	}

}

public class LoginFilter extends UsernamePasswordAuthenticationFilter {

    @Autowired
    private SessionRegistry sessionRegistry;

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        if (!request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
        }
        if (MediaType.APPLICATION_JSON_VALUE.equals(request.getContentType()) ||
                MediaType.APPLICATION_JSON_UTF8_VALUE.equals(request.getContentType())) {
            try {
                Map<String, String> map = new ObjectMapper().readValue(request.getInputStream(), Map.class);
                String username = map.get(getUsernameParameter());
                String password = map.get(getPasswordParameter());
                UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
                // Allow subclasses to set the "details" property
                setDetails(request, authRequest);
                return this.getAuthenticationManager().authenticate(authRequest);
            } catch (IOException e) {
                throw new RuntimeException(e);
            }
        }
        return super.attemptAuthentication(request, response);
    }

}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

	@Bean
    public UserDetailsService userDetailsService() {
        InMemoryUserDetailsManager userDetailsManager = new InMemoryUserDetailsManager();
        userDetailsManager.createUser(User.builder().username("root").password("{noop}123").authorities("admin").build());
        return userDetailsManager;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService());
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

	// 使用默認的 SessionRegistryImpl 實現(xiàn)類作為 Bean 類型即可
    @Bean
    public SessionRegistry sessionRegistry() {
        return new SessionRegistryImpl();
    }
    
	@Bean
    public LoginFilter loginFilter() throws Exception {
        LoginFilter loginFilter = new LoginFilter();
        loginFilter.setFilterProcessesUrl("/login");
        loginFilter.setAuthenticationManager(authenticationManagerBean());
        loginFilter.setAuthenticationSuccessHandler((request, response, authentication) -> {
            response.setStatus(200);
            response.setContentType("application/json;charset=UTF-8");
            response.getWriter().println("登錄成功！");
        });
        loginFilter.setAuthenticationFailureHandler((request, response, exception) -> {
            response.setStatus(500);
            response.setContentType("application/json;charset=UTF-8");
            response.getWriter().println("登錄失??！");
            response.getWriter().println(exception.getMessage());
            response.getWriter().flush();
        });
        // ???????????????????????????????????????
        // 為自定義的認證過濾器封裝 SessionAuthenticationStrategy。需要兩個 Strategy 組合使用才能發(fā)揮作用
        // ConcurrentSessionControlAuthenticationStrategy -》 控制并發(fā)數(shù)，讓超出的并發(fā)會話過期【ConcurrentSessionFilter 會在過期會話再次請求資源時，將過期會話進行 logout 操作并重定向到登錄頁面】
        // RegisterSessionAuthenticationStrategy -》注冊新會話進 SessionRegistry 實例中
        ConcurrentSessionControlAuthenticationStrategy strategy1 = new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry());
        RegisterSessionAuthenticationStrategy strategy2 = new RegisterSessionAuthenticationStrategy(sessionRegistry());
        CompositeSessionAuthenticationStrategy compositeStrategy = new CompositeSessionAuthenticationStrategy(Arrays.asList(strategy1, strategy2));
        loginFilter.setSessionAuthenticationStrategy(compositeStrategy);
        return loginFilter;
    }
   
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

	// .......
	// 省略第3步中已經(jīng)貼出來的配置代碼
	
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests().anyRequest().authenticated()
                .and().csrf().disable()
                .exceptionHandling().authenticationEntryPoint((request, response, authException) -> {
                    response.setStatus(401);
                    response.setContentType("application/json;charset=UTF-8");
                    response.getWriter().println("未認證，請登錄！");
                    response.getWriter().flush();
                })
                // 開啟會話管理，設(shè)置會話最大并發(fā)數(shù)為 1
                .and().sessionManagement().maximumSessions(1)
                // 控制的是 ConcurrentSessionFilter 的 this.sessionInformationExpiredStrategy 屬性的實例化賦值對象
                .expiredSessionStrategy(event -> {
                    HttpServletResponse response = event.getResponse();
                    response.setContentType("application/json;charset=UTF-8");
                    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                    Map<String, String> result = new HashMap<>();
                    result.put("msg", "當前用戶已在其他設(shè)備登錄，請重新登錄！");
                    response.getWriter().println(new ObjectMapper().writeValueAsString(result));
                })
        ;
        http.addFilterAt(loginFilter(), UsernamePasswordAuthenticationFilter.class);
    }
}