java - session 超时不起作用 vaadin

Question

我正在开发一个 vaadin Web 应用程序，并在 web.xml 中添加了以下代码片段。

<session-config>
    <session-timeout>30</session-timeout>
</session-config>

现在我注意到 30 分钟后我的用户也可以使用该应用程序，但我不希望这样。我在 vaadin 的书上读到了一些关于这个问题的内容，但我没有理解一些东西。

摘自瓦丁书:

Session Timeout After User Inactivity

In normal servlet operation, the session timeout defines the allowed time of inactivity after which the server should clean up the session. The inactivity is measured from the last server request. Different servlet containers use varying defaults for timeouts, such as 30 minutes for Apache Tomcat. You can set the timeout under with:

In a web.xml:

<session-config>
   <session-timeout>30</session-timeout> 
  </session-config>

The session timeout should be longer than the heartbeat interval or otherwise sessions are closed before the heartbeat can keep them alive. As the session expiration leaves the UIs in a state where they assume that the session still exists, this would cause an Out Of Sync error notification in the browser.

However, having a shorter heartbeat interval than the session timeout, which is the normal case, prevents the sessions from expiring. If the closeIdleSessions parameter for the servlet is enabled (disabled by default), Vaadin closes the UIs and the session after the time specified in the session-timeout parameter expires after the last non-heartbeat request.

In a web.xml:

<servlet>
...
<init-param>
  <param-name>closeIdleSessions</param-name>
  <param-value>true</param-value>
</init-param>

现在我认为问题是我的应用程序服务器将 UI 置于假定 session 仍然存在的状态，但我无法理解什么是心跳？ closeSessionId 到底做什么？

Answer 1

心跳表明客户端仍然存在。 例如当用户关闭浏览器时，客户端无法再发送心跳， 服务器检测到这一点并清理服务器端的 UI。 默认情况下，这会使 session 永远保持 Activity 状态。 因此，如果这不是预期的行为，您必须在 web.xml 中进行设置:

<init-param>
    <description>Enable Session Timeout</description>
    <param-name>closeIdleSessions</param-name>
    <param-value>true</param-value>
</init-param>