Spring Boot内嵌Tomcat session超时问题

最近让Spring Boot内嵌Tomcat的session超时问题给坑了一把。

在应用中须要设置session超时时间，而后就习惯的在application.properties配置文件中设置以下，

server.session.timeout=90

这里把超时时间设置的短些，主要想看看到底有没有起做用（不能设值30min而后再看吧，那样太不人道了）。结果没起做用，百度下发现Spring Boot 2后，配置变成以下，

server.servlet.session.timeout=90

但结果依然不起做用，后来就断断续续的懵了逼的找问题缘由，各类百度，google，最后以为仍是看源代码吧，顺便也学习下。

1. 既然是Session超时时间问题，那就看看对Session的实现 - StandardSession

其中有isValid()方法

    /**
     * Return the <code>isValid</code> flag for this session.
     */
    @Override
    public boolean isValid() {

        if (!this.isValid) {
            return false;
        }

        if (this.expiring) {
            return true;
        }

        if (ACTIVITY_CHECK && accessCount.get() > 0) {
            return true;
        }

        if (maxInactiveInterval > 0) {
            int timeIdle = (int) (getIdleTimeInternal() / 1000L);
            if (timeIdle >= maxInactiveInterval) {
                expire(true);
            }
        }

        return this.isValid;
    }

看了下，这里的 timeIdle >= maxInactiveInterval就是触发session超时的判断，知足则调用 expire(true)。那么问题就来了，何时调用isValid()？

2. 后台确定有定时调用isValid()的线程

查看调用isValid()的相关类以下，StandardManager和ManagerBase入了法眼了。

StandardManager中的注解代表是用来让全部存活的session过时的，应该是在web容器销毁时调用的，因此就只看 ManagerBase

        // Expire all active sessions
        Session sessions[] = findSessions();
        for (int i = 0; i < sessions.length; i++) {
            Session session = sessions[i];
            try {
                if (session.isValid()) {
                    session.expire();
                }
            } catch (Throwable t) {
                ExceptionUtils.handleThrowable(t);
            } finally {
                // Measure against memory leaking if references to the session
                // object are kept in a shared field somewhere
                session.recycle();
            }
        }

ManagerBase，注解代表是咱们想要的，接下来看调用processExpires()的类。仍是ManagerBase。

    /**
     * Invalidate all sessions that have expired. */
    public void processExpires() {

        long timeNow = System.currentTimeMillis();
        Session sessions[] = findSessions();
        int expireHere = 0 ;

        if(log.isDebugEnabled())
            log.debug("Start expire sessions " + getName() + " at " + timeNow + " sessioncount " + sessions.length);
        for (int i = 0; i < sessions.length; i++) {
            if (sessions[i]!=null && !sessions[i].isValid()) {
                expireHere++;
            }
        }
        long timeEnd = System.currentTimeMillis();
        if(log.isDebugEnabled())
             log.debug("End expire sessions " + getName() + " processingTime " + (timeEnd - timeNow) + " expired sessions: " + expireHere);
        processingTime += ( timeEnd - timeNow );

    }

调用processExpires()

    /**
     * Frequency of the session expiration, and related manager operations.
     * Manager operations will be done once for the specified amount of
     * backgroundProcess calls (ie, the lower the amount, the most often the
     * checks will occur).
     */
    protected int processExpiresFrequency = 6;

    /**
     * {@inheritDoc}
     * <p>
     * Direct call to {@link #processExpires()}
     */
    @Override
    public void backgroundProcess() {
        count = (count + 1) % processExpiresFrequency;
        if (count == 0)
            processExpires();
    }

看到backgroundProcess()方法名就知道离真理不远了。其调用以下，在StandardContext类中，

    @Override
    public void backgroundProcess() {

        if (!getState().isAvailable())
            return;

        Loader loader = getLoader();
        if (loader != null) {
            try {
                loader.backgroundProcess();
            } catch (Exception e) {
                log.warn(sm.getString(
                        "standardContext.backgroundProcess.loader", loader), e);
            }
        }
        Manager manager = getManager();
        if (manager != null) {
            try {
                manager.backgroundProcess();
            } catch (Exception e) {
                log.warn(sm.getString(
                        "standardContext.backgroundProcess.manager", manager),
                        e);
            }
        }
        WebResourceRoot resources = getResources();
        if (resources != null) {
            try {
                resources.backgroundProcess();
            } catch (Exception e) {
                log.warn(sm.getString(
                        "standardContext.backgroundProcess.resources",
                        resources), e);
            }
        }
        InstanceManager instanceManager = getInstanceManager();
        if (instanceManager instanceof DefaultInstanceManager) {
            try {
                ((DefaultInstanceManager)instanceManager).backgroundProcess();
            } catch (Exception e) {
                log.warn(sm.getString(
                        "standardContext.backgroundProcess.instanceManager",
                        resources), e);
            }
        }
        super.backgroundProcess();
    }

可是尚未看到线程的建立，继续查看调用，ContainerBase.ContainerBackgroundProcessor

    /**
     * Private thread class to invoke the backgroundProcess method
     * of this container and its children after a fixed delay.
     */
    protected class ContainerBackgroundProcessor implements Runnable 

                while (!threadDone) {
                    try {
                        Thread.sleep(backgroundProcessorDelay * 1000L);
                    } catch (InterruptedException e) {
                        // Ignore
                    }
                    if (!threadDone) {
                        processChildren(ContainerBase.this);
                    }
                }

看到曙光了！看来后台线程每隔 backgroundProcessorDelay * processExpiresFrequency (s)来判断session是否过时。

默认值：

backgroundProcessorDelay  = 30s

ServerProperties.class
　　　　　/**
         * Delay between the invocation of backgroundProcess methods. If a duration suffix
         * is not specified, seconds will be used.
         */
        @DurationUnit(ChronoUnit.SECONDS)
        private Duration backgroundProcessorDelay = Duration.ofSeconds(30);

processExpiresFrequency = 6

因此默认状况下后台线程每隔3min去判断session是否超时。这样我以前设置server.servlet.session.timeout=90s，没办法看到效果的。

另外还要注意后台对timeout的处理以min为单位，即90s在后台会认为是1min的。

TomcatServletWebServerFactory.class

    private long getSessionTimeoutInMinutes() {
        Duration sessionTimeout = getSession().getTimeout();
        if (isZeroOrLess(sessionTimeout)) {
            return 0;
        }
        return Math.max(sessionTimeout.toMinutes(), 1);
    }