我正在尝试实现一个登录(记住我)应用程序，但我在管理 cookie 时遇到了问题。当我在注册(对于新成员(member))或登录(对于已经注册的成员(member))时，我在服务器上做:

Cookie returnVisitorCookie = new Cookie("repeatVisitor", "yes");
returnVisitorCookie.setMaxAge(60*60*24*365); // 1 year
response.addCookie(returnVisitorCookie);

我从浏览器获得的响应。例如:visitor.login(response)。

当我执行 SIGNOUT 时，我正在删除 cookie。但我好像有更多的 cookies 它应该是，我的意思是如果我注册了 2 个成员并注销，我仍然有名称 =“repeatVisitor”和值 ="is"的 cookie。

可能是因为我将 cookie 放在不同的响应中。

任何人都可以告诉我我做错了什么，我应该如何实现？ 谢谢

最佳答案

有时我发现最好的学习或理解方法是看一个例子。这是我们用于工作网站的一些代码:

@WebServlet(name = "Login", urlPatterns = {"/authorization/Login"})
public class Login extends HttpServlet {

    /**
     * Processes requests for both HTTP
     * <code>GET</code> and
     * <code>POST</code> methods.
     *
     * @param request servlet request
     * @param response servlet response
     * @throws ServletException if a servlet-specific error occurs
     * @throws IOException if an I/O error occurs
     */
    protected void processRequest(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        response.setContentType("text/html;charset=UTF-8");

        PrintWriter out = response.getWriter();
        try {
            System.out.println("Reached login");
            if (!Authorization.isLoggedIn(request)) {
                String login = request.getParameter("login");
                String password = request.getParameter("password");
                boolean remember = Boolean.parseBoolean(request.getParameter("remember"));

                System.out.println("Reached login "+login+", "+password+","+remember);
                if (!Authorization.validateLogin(login, password)) {
                    Logger.getLogger(Login.class.getName()).log(Level.INFO,
                            "Failed login (invalid password) from {0} for {1}",
                            new String[]{request.getRemoteAddr(), login});
                    response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid username or password!");
                    return;
                }
                //So far so good... Get the user object from the database (unique login names)
                DB_User user = DB_User.get(login);
                if (!user.getActive()) {
                    response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Your account is no longer active!");
                    return;
                }
                String sessionID = Authorization.createNewSession(user, request.getRemoteAddr(), remember);
                Cookie sessionCookie = new Cookie("my_application.session_id", sessionID);
                sessionCookie.setDomain(request.getServerName());
                sessionCookie.setPath(request.getContextPath());
                if (remember) {
                    sessionCookie.setMaxAge(ServerConfig.getLoginSessionTimeout());
                }

                response.addCookie(sessionCookie);
            }
            response.sendRedirect("/app/myAccount.jsp");
        } catch (Throwable ex) {
            Logger.getLogger(Login.class.getName()).log(Level.SEVERE, null, ex);
            ServletUtils.handleException(ex, response);
        } finally {
            out.flush();
            out.close();
        }
    }

    // +HttpSerlet default methods here. (doGet, doPost, getServletInfo)
}

注销 servlet 示例:

@WebServlet(name = "Logout", urlPatterns = {"/authorization/Logout"})
public class Logout extends HttpServlet {

    /**
     * Processes requests for both HTTP
     * <code>GET</code> and
     * <code>POST</code> methods.
     *
     * @param request servlet request
     * @param response servlet response
     * @throws ServletException if a servlet-specific error occurs
     * @throws IOException if an I/O error occurs
     */
    protected void processRequest(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        response.setContentType("text/html;charset=UTF-8");
        PrintWriter out = response.getWriter();
        try {
            String sessionID = ServletUtils.getCookieValue(request.getCookies(),"my_application.session_id");

            if (sessionID != null) {
                SQLManager sql = ServerConfig.getSql();
                sql.deleteFromTable("login_session", "session_id = " + SQLString.toSql(sessionID));

                Cookie sessionCookie = new Cookie("my_application.session_id", null);
                sessionCookie.setDomain(ServletUtils.getCookieDomain(request));
                sessionCookie.setPath("/you_app_name");
                sessionCookie.setMaxAge(0);
                response.addCookie(sessionCookie);
            }
            response.sendRedirect("/security/login.jsp");

        } catch (Throwable ex) {
            Logger.getLogger(Logout.class.getName()).log(Level.SEVERE, null, ex);
            ServletUtils.handleException(ex, response);
        } finally {
            out.close();
        }
    }
}

如您所见，我们制作了一些辅助类，但概念仍然存在。希望这有帮助

关于java - 登录，记住我，使用 java servlet 和 jsp 的应用程序，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/13126262/