单机登录实现思路（强制下线其他用户）

主流的网站都是限制用户单点登录的，为什么要实现单点登录？

1、避免单账号多用户操作占用大量数据库连接，减轻webserver的压力；

2、安全防范，强制下线非法用户；

传统的web服务器（如tomcat）对session有专门的管理，我们通过session来控制用户的登录生存周期。单点登录原理如下：

1、将当前的session以Collections的形式缓存在application当中，用户产生新的session，即清除用户之前的session，保证collection里面的usersession都是唯一的；

2、实现效果每次用户登录都会挤掉之前用户的登录，每个用户只能唯一在线；

        ServletContext application = request.getSession().getServletContext();
        Collection<HttpSession> sessions = null;
        if (application.getAttribute("usercount") == null) {
            sessions = new ArrayList<HttpSession>();
            application.setAttribute("usercount", sessions);
        } else {
            sessions = (Collection<HttpSession>) application
                    .getAttribute("usercount");
        }
        new LoginManager().login(sessions, session);
        SessionHandler.handleSession(session);

    public static boolean isLogin(HttpServletRequest request) {
        TuserEntity tuser = getUser(request);
        
        if(tuser!=null){
            Map<String, HttpSession> map = (Map<String, HttpSession>) request.getSession()
                                                        .getServletContext().getAttribute("sessionMap");
            if(map.get(tuser.getLogname())==null){
                request.getSession().invalidate();
                return false;
            }
        }
        return getUser(request) != null;
    }

LoginManager.java

public class LoginManager {

    public HttpSession login(Collection<HttpSession> sessions,
            HttpSession session) {
        ArrayList<HttpSession> sessionde = new ArrayList<HttpSession>();

        for (HttpSession s : sessions) {
            try {
                int historyuser = ((TuserEntity) s.getAttribute("user_session")).getId();
                int nowuser = ((TuserEntity) session.getAttribute("user_session"))
                .getId();
                if (historyuser == nowuser) {

                    sessions.remove(s); // 移除集合中的重复session元素

                    if(!s.equals(session)){
                        s.invalidate();// 废弃之前登陆的session
                    }
                    break;
                }

            } catch (Exception e) {
                //e.printStackTrace();
                sessionde.add(s);
            } 

        }
        for (int i = 0; i < sessionde.size(); i++) {
            sessions.remove((HttpSession) sessionde.get(i));
        }
        sessions.add(session);
        return null;
    }
}

　　

新增和废弃ServletContext里面的sessionMap的用户session

    public static void handleSession(HttpSession session) {
        try {
            Map<String, HttpSession> sessionMap = (Map<String, HttpSession>) session.getServletContext().getAttribute("sessionMap");
            TuserEntity tuser = (TuserEntity) session.getAttribute(Keys.USER_SESSION_KEY);
            if(sessionMap.get(tuser.getLogname())!=null){
                sessionMap.remove(tuser.getLogname());
            }
            sessionMap.put(tuser.getLogname(), session);
        } catch (Exception e) {
            System.out.println("session error!");
        }
    }

    public void sessionDestroyed(HttpSessionEvent se) {
        Map<String, HttpSession> sessionMap = (Map<String, HttpSession>) se.getSession().getServletContext().getAttribute("sessionMap");
        TuserEntity tuser = (TuserEntity) se.getSession().getAttribute(Keys.USER_SESSION_KEY);
        if(tuser!=null){
            sessionMap.remove(tuser.getLogname());
        }
    }