单机登录实现思路（强制下线其他用户）

主流的网站都是限制用户单点登录的，为什么要实现单点登录？

1、避免单账号多用户操作占用大量数据库连接，减轻webserver的压力；

2、安全防范，强制下线非法用户；

传统的web服务器（如tomcat）对session有专门的管理，我们通过session来控制用户的登录生存周期。单点登录原理如下：

1、将当前的session以Collections的形式缓存在application当中，用户产生新的session，即清除用户之前的session，保证collection里面的usersession都是唯一的；

2、实现效果每次用户登录都会挤掉之前用户的登录，每个用户只能唯一在线；

ServletContext application = request.getSession().getServletContext();
Collection<HttpSession> sessions = null;
if (application.getAttribute("usercount") == null) {
sessions = new ArrayList<HttpSession>();
application.setAttribute("usercount", sessions);
} else {
sessions = (Collection<HttpSession>) application
.getAttribute("usercount");
}
new LoginManager().login(sessions, session);
SessionHandler.handleSession(session);

public static boolean isLogin(HttpServletRequest request) {
TuserEntity tuser = getUser(request);

if(tuser!=null){
Map<String, HttpSession> map = (Map<String, HttpSession>) request.getSession()
.getServletContext().getAttribute("sessionMap");
if(map.get(tuser.getLogname())==null){
request.getSession().invalidate();
return false;
}
}
return getUser(request) != null;
}

LoginManager.java

public class LoginManager {

public HttpSession login(Collection<HttpSession> sessions,
HttpSession session) {
ArrayList<HttpSession> sessionde = new ArrayList<HttpSession>();

for (HttpSession s : sessions) {
try {
int historyuser = ((TuserEntity) s.getAttribute("user_session")).getId();
int nowuser = ((TuserEntity) session.getAttribute("user_session"))
.getId();
if (historyuser == nowuser) {

sessions.remove(s); // 移除集合中的重复session元素

if(!s.equals(session)){
s.invalidate();// 废弃之前登陆的session
}
break;
}

} catch (Exception e) {
//e.printStackTrace();
sessionde.add(s);
}

}
for (int i = 0; i < sessionde.size(); i++) {
sessions.remove((HttpSession) sessionde.get(i));
}
sessions.add(session);
return null;
}
}

　　

新增和废弃ServletContext里面的sessionMap的用户session

public static void handleSession(HttpSession session) {
try {
Map<String, HttpSession> sessionMap = (Map<String, HttpSession>) session.getServletContext().getAttribute("sessionMap");
TuserEntity tuser = (TuserEntity) session.getAttribute(Keys.USER_SESSION_KEY);
if(sessionMap.get(tuser.getLogname())!=null){
sessionMap.remove(tuser.getLogname());
}
sessionMap.put(tuser.getLogname(), session);
} catch (Exception e) {
System.out.println("session error!");
}
}

public void sessionDestroyed(HttpSessionEvent se) {
Map<String, HttpSession> sessionMap = (Map<String, HttpSession>) se.getSession().getServletContext().getAttribute("sessionMap");
TuserEntity tuser = (TuserEntity) se.getSession().getAttribute(Keys.USER_SESSION_KEY);
if(tuser!=null){
sessionMap.remove(tuser.getLogname());
}
}