Shiro源代码分析之两种Session的方式

 <!-- 定义 Shiro 主要业务对象 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <!-- <property name="sessionManager" ref="sessionManager" /> -->
        <property name="realm" ref="systemAuthorizingRealm" />
        <property name="cacheManager" ref="shiroCacheManager" />
    </bean>

public DefaultWebSecurityManager() {
        super();
        ((DefaultSubjectDAO) this.subjectDAO).setSessionStorageEvaluator(new DefaultWebSessionStorageEvaluator());
        this.sessionMode = HTTP_SESSION_MODE;
        setSubjectFactory(new DefaultWebSubjectFactory());
        setRememberMeManager(new CookieRememberMeManager());
        setSessionManager(new ServletContainerSessionManager());
    }

publicSession getSession(SessionKey key) throws SessionException {

        if (!WebUtils.isHttp(key)) { //推断是不是http的key，否则抛异常
            String msg = "SessionKey must be an HTTP compatible implementation.";
            throw new IllegalArgumentException(msg);
        }
        HttpServletRequest request = WebUtils.getHttpRequest(key); //通过工具类获得HttpServletRequest 这类是javax.servlet.http.HttpServletRequest;
        Session session = null;
        HttpSession httpSession = request.getSession(false);//先从request里获得本来存在的
        if (httpSession != null) {
            session = createSession(httpSession, request.getRemoteHost());//假设不为空，就创建一个封装了的，为空就无论它
        }
        return session;
    }

@Override

    protected SessionKey getSessionKey(SubjectContext context) {
        if (WebUtils.isWeb(context)) {
            Serializable sessionId = context.getSessionId();
            ServletRequest request = WebUtils.getRequest(context);
            ServletResponse response = WebUtils.getResponse(context);
            return new WebSessionKey(sessionId, request, response);
        } else {
            return super.getSessionKey(context);
        }
    }

protectedSession createSession(HttpSession httpSession, String host) {

        return new HttpServletSession(httpSession, host);
    }

public class HttpServletSession implements Session {
    private HttpSession httpSession = null;
    public HttpServletSession(HttpSession httpSession, String host) {
        if (httpSession == null) {
            String msg = "HttpSession constructor argument cannot be null.";
            throw new IllegalArgumentException(msg);
        }
        if (httpSession instanceof ShiroHttpSession) {
            String msg = "HttpSession constructor argument cannot be an instance of ShiroHttpSession.  This " +
                    "is enforced to prevent circular dependencies and infinite loops.";
            throw new IllegalArgumentException(msg);
        }
        this.httpSession = httpSession;
        if (StringUtils.hasText(host)) {
            setHost(host);
        }
    }
……………………
……………………
………………
    public Object getAttribute(Object key) throws InvalidSessionException {
        try {
            return httpSession.getAttribute(assertString(key));
        } catch (Exception e) {
            throw new InvalidSessionException(e);
        }
    }
    public void setAttribute(Object key, Object value) throws InvalidSessionException {
        try {
            httpSession.setAttribute(assertString(key), value);
        } catch (Exception e) {
            throw new InvalidSessionException(e);
        }
    }
 ………………
 ………………
}

publicSession getSession(boolean create) {

            if (log.isTraceEnabled()) {
                log.trace("attempting to get session; create = " + create +
                        "; session is null = " + (this.session == null) +
                        "; session has id = " + (this.session != null && session.getId() != null));
            }
            if (this.session == null && create) {//session为空，而且能创建
         ……
         ……省略
         ……
                SessionContext sessionContext = createSessionContext();
                Session session = this.securityManager.start(sessionContext);//在这里创建Session
                this.session = decorate(session);//包装Session，他自己建的自己也去包装一下
            }

public Session start(SessionContext context) throws AuthorizationException {
        return this.sessionManager.start(context);
    }

publicSession start(SessionContext context) {

        Session session = createSession(context);//创建Session
        applyGlobalSessionTimeout(session);
        onStart(session, context);
        notifyStart(session);
        return createExposedSession(session, context);
    }

protectedSession createSession(SessionContext context) throwsAuthorizationException {

        enableSessionValidationIfNecessary();
        return doCreateSession(context);
    }
    protected abstract Session doCreateSession(SessionContext initData) throws AuthorizationException;

publicSession createSession(SessionContext initData) {

        if (initData != null) {
            String host = initData.getHost();
            if (host != null) {
                return new SimpleSession(host);
            }
        }
        return new SimpleSession();
    }

protected Session doCreateSession(SessionContext context) {
        Session s = newSessionInstance(context);
        if (log.isTraceEnabled()) {
            log.trace("Creating session for host {}", s.getHost());
        }
        create(s);
        return s;
    }

protectedvoid cache(Session session, Serializable sessionId) {

        if (session == null || sessionId == null) {
            return;
        }
        Cache<Serializable, Session> cache = getActiveSessionsCacheLazy();//获取缓存
        if (cache == null) {
            return;
        }
        cache(session, sessionId, cache);//有缓存就存起来
    }

publicObject getAttribute(SessionKey sessionKey, Object attributeKey)throws InvalidSessionException {

        return lookupRequiredSession(sessionKey).getAttribute(attributeKey);
    }

 public Session readSession(Serializable sessionId) throws UnknownSessionException {
        Session s = getCachedSession(sessionId);
        if (s == null) {
            s = super.readSession(sessionId);
        }
        return s;
    }

    protected Session getCachedSession(Serializable sessionId) {
        Session cached = null;
        if (sessionId != null) {
            Cache<Serializable, Session> cache = getActiveSessionsCacheLazy();
            if (cache != null) {
                cached = getCachedSession(sessionId, cache);
            }
        }
        return cached;
    }