import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
/**
 * Populate the model in the following order:
 * <ol>
 * 	<li>Retrieve "known" session attributes -- i.e. attributes listed via
 * 	{@link SessionAttributes @SessionAttributes} and previously stored in
 * 	the in the model at least once
 * 	<li>Invoke {@link ModelAttribute @ModelAttribute} methods
 * 	<li>Find method arguments eligible as session attributes and retrieve
 * 	them if they're not	already	present in the model
 * </ol>
 * @param request the current request
 * @param mavContainer contains the model to be initialized
 * @param handlerMethod the method for which the model is initialized
 * @throws Exception may arise from {@code @ModelAttribute} methods
 */
public void initModel(NativeWebRequest request, ModelAndViewContainer mavContainer, HandlerMethod handlerMethod)
		throws Exception {

	Map<String, ?> attributesInSession = this.sessionAttributesHandler.retrieveAttributes(request);
	mavContainer.mergeAttributes(attributesInSession);

	invokeModelAttributeMethods(request, mavContainer);

	for (String name : findSessionAttributeArguments(handlerMethod)) {
		if (!mavContainer.containsAttribute(name)) {
			Object value = this.sessionAttributesHandler.retrieveAttribute(request, name);
			if (value == null) {
				throw new HttpSessionRequiredException("Expected session attribute '" + name + "'");
			}
			mavContainer.addAttribute(name, value);
		}
	}
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
@Test
public void sessionRequiredCatchable() throws Exception {
	HttpServletRequest request = new MockHttpServletRequest("GET", "/testSession.html");
	HttpServletResponse response = new MockHttpServletResponse();
	TestMaController contr = new TestSessionRequiredController();
	try {
		contr.handleRequest(request, response);
		fail("Should have thrown exception");
	}
	catch (HttpSessionRequiredException ex) {
		// assertTrue("session required", ex.equals(t));
	}
	request = new MockHttpServletRequest("GET", "/testSession.html");
	response = new MockHttpServletResponse();
	contr = new TestSessionRequiredExceptionHandler();
	ModelAndView mv = contr.handleRequest(request, response);
	assertTrue("Name is ok", mv.getViewName().equals("handle(SRE)"));
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
/**
 * Populate the model in the following order:
 * <ol>
 * 	<li>Retrieve "known" session attributes listed as {@code @SessionAttributes}.
 * 	<li>Invoke {@code @ModelAttribute} methods
 * 	<li>Find {@code @ModelAttribute} method arguments also listed as
 * 	{@code @SessionAttributes} and ensure they're present in the model raising
 * 	an exception if necessary.
 * </ol>
 * @param request the current request
 * @param mavContainer a container with the model to be initialized
 * @param handlerMethod the method for which the model is initialized
 * @throws Exception may arise from {@code @ModelAttribute} methods
 */
public void initModel(NativeWebRequest request, ModelAndViewContainer mavContainer, HandlerMethod handlerMethod)
		throws Exception {

	Map<String, ?> sessionAttributes = this.sessionAttributesHandler.retrieveAttributes(request);
	mavContainer.mergeAttributes(sessionAttributes);

	invokeModelAttributeMethods(request, mavContainer);

	for (String name : findSessionAttributeArguments(handlerMethod)) {
		if (!mavContainer.containsAttribute(name)) {
			Object value = this.sessionAttributesHandler.retrieveAttribute(request, name);
			if (value == null) {
				throw new HttpSessionRequiredException("Expected session attribute '" + name + "'");
			}
			mavContainer.addAttribute(name, value);
		}
	}
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
@Test
public void sessionAttributeNotPresent() throws Exception {
	ModelFactory modelFactory = new ModelFactory(null, null, this.sessionAttrsHandler);

	try {
		modelFactory.initModel(this.webRequest, new ModelAndViewContainer(), this.handleSessionAttrMethod);
		fail("Expected HttpSessionRequiredException");
	}
	catch (HttpSessionRequiredException e) {
		// expected
	}

	this.sessionAttributeStore.storeAttribute(this.webRequest, "sessionAttr", "sessionAttrValue");
	ModelAndViewContainer mavContainer = new ModelAndViewContainer();
	modelFactory.initModel(this.webRequest, mavContainer, this.handleSessionAttrMethod);

	assertEquals("sessionAttrValue", mavContainer.getModel().get("sessionAttr"));
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
@RequestMapping("**")
public ResponseEntity _index(HttpServletRequest request, HttpServletResponse response)
		throws IOException, HttpSessionRequiredException, DocumentException {
	{
		JSONObject lJsonObjLog = new JSONObject();
		lJsonObjLog.put("sessionId", request.getSession().getId());
		lJsonObjLog.put("remoteAddress", request.getRemoteAddr() + ":" + request.getRemotePort());
		lJsonObjLog.put("url", request.getRequestURI());
		lJsonObjLog.put("httpHeaders", getHeaders(request));
		mLogger.info(lJsonObjLog.toString());
	}
	if (request.getRequestURI().endsWith(".xml")) {
		return acceptXmlDownload(request, response);
	} else {
		return acceptAnythingDownload(request, response);
	}
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
/**
 * Reduce remaining bytes length
 *
 * @param size Length of bytes try to read from InputStream.
 * @return The actual length of bytes can read from InputStream.
 * @throws HttpSessionRequiredException Session ID not found
 */
private long reduceRemainingBytes(long size) throws HttpSessionRequiredException {
	HttpSession lSession = getHttpSessionOrThrow();
	Long ljRemainingBytes = getRemainingBytes();

	long temp = ljRemainingBytes - size;
	if (temp < 0) {
		size = ljRemainingBytes.intValue();
		ljRemainingBytes = 0L;
	} else {
		ljRemainingBytes = temp;
	}

	lSession.setAttribute(ApplicationConstants.KEY_BANDWIDTH_LIMIT_REMAINING_BYTES, ljRemainingBytes);
	return size;
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
/**
 * Check and prepare the given request and response according to the settings
 * of this generator. Checks for supported methods and a required session,
 * and applies the given number of cache seconds.
 * @param request current HTTP request
 * @param response current HTTP response
 * @param cacheSeconds positive number of seconds into the future that the
 * response should be cacheable for, 0 to prevent caching
 * @param lastModified if the mapped handler provides Last-Modified support
 * @throws ServletException if the request cannot be handled because a check failed
 */
protected final void checkAndPrepare(
		HttpServletRequest request, HttpServletResponse response, int cacheSeconds, boolean lastModified)
		throws ServletException {

	// Check whether we should support the request method.
	String method = request.getMethod();
	if (this.supportedMethods != null && !this.supportedMethods.contains(method)) {
		throw new HttpRequestMethodNotSupportedException(
				method, StringUtils.toStringArray(this.supportedMethods));
	}

	// Check whether a session is required.
	if (this.requireSession) {
		if (request.getSession(false) == null) {
			throw new HttpSessionRequiredException("Pre-existing session required but none found");
		}
	}

	// Do declarative cache control.
	// Revalidate if the controller supports last-modified.
	applyCacheSeconds(response, cacheSeconds, lastModified);
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
public void testSessionRequiredCatchable() throws Exception {
	HttpServletRequest request = new MockHttpServletRequest("GET", "/testSession.html");
	HttpServletResponse response = new MockHttpServletResponse();
	TestMaController contr = new TestSessionRequiredController();
	try {
		contr.handleRequest(request, response);
		fail("Should have thrown exception");
	}
	catch (HttpSessionRequiredException ex) {
		// assertTrue("session required", ex.equals(t));
	}
	request = new MockHttpServletRequest("GET", "/testSession.html");
	response = new MockHttpServletResponse();
	contr = new TestSessionRequiredExceptionHandler();
	ModelAndView mv = contr.handleRequest(request, response);
	assertTrue("Name is ok", mv.getViewName().equals("handle(SRE)"));
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
@ExceptionHandler({
        SessionLimitExceededException.class,
        HttpSessionRequiredException.class,
        SessionException.class,
        SessionAuthenticationException.class,
        })
public String handleSessionRequired(Exception e, RedirectAttributes attr){
    attr.addFlashAttribute("error","Your session has been expired. Please log in again.");
    return "redirect:/error";
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
@ExceptionHandler({

            HttpSessionRequiredException.class,
            SessionException.class,
            SessionAuthenticationException.class,
            })
    public String handleSessionRequired(Exception e, RedirectAttributes attr){
        e.printStackTrace();
        attr.addFlashAttribute("error","Your session has been expired. Please log in again.");
        return "redirect:/oups";
    }
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
/**
 * Check the given request for supported methods and a required session, if any.
 * @param request current HTTP request
 * @throws ServletException if the request cannot be handled because a check failed
 * @since 4.2
 */
protected final void checkRequest(HttpServletRequest request) throws ServletException {
	// Check whether we should support the request method.
	String method = request.getMethod();
	if (this.supportedMethods != null && !this.supportedMethods.contains(method)) {
		throw new HttpRequestMethodNotSupportedException(
				method, StringUtils.toStringArray(this.supportedMethods));
	}

	// Check whether a session is required.
	if (this.requireSession && request.getSession(false) == null) {
		throw new HttpSessionRequiredException("Pre-existing session required but none found");
	}
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
/**
 * Construct a InputStream with limited bandwidth.
 *
 * @param in        the underlying input stream, or <code>null</code> if
 *                  this instance is to be created without an underlying stream.
 * @param sessionId HttpSession ID.
 * @param bandwidth Bandwidth limit in Bytes/s.
 * @throws HttpSessionRequiredException Session ID not found.
 */
public LimitedBandwidthInputStream(InputStream in, String sessionId, long bandwidth) throws HttpSessionRequiredException {
	super(in);
	this.SESSION_ID = sessionId;
	this.BANDWIDTH = bandwidth;

	// Init Last reset time and Bandwidth.
	{
		HttpSession lSession = getHttpSessionOrThrow();
		lSession.setAttribute(ApplicationConstants.KEY_BANDWIDTH_LIMIT_LAST_RESET_TIME, System.currentTimeMillis());
		lSession.setAttribute(ApplicationConstants.KEY_BANDWIDTH_LIMIT_REMAINING_BYTES, BANDWIDTH);
	}
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
private long getRemainingBytes() throws HttpSessionRequiredException {
	HttpSession lSession = getHttpSessionOrThrow();
	Long ljRemainingBytes = (Long) lSession.getAttribute(ApplicationConstants.KEY_BANDWIDTH_LIMIT_REMAINING_BYTES);
	if (ljRemainingBytes == null) {
		ljRemainingBytes = BANDWIDTH;
		lSession.setAttribute(ApplicationConstants.KEY_BANDWIDTH_LIMIT_REMAINING_BYTES, ljRemainingBytes);
	}
	return ljRemainingBytes;
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
private boolean resetRemainingBytes() throws HttpSessionRequiredException {
	HttpSession lSession = getHttpSessionOrThrow();
	Long ljLastResetTimeMillis = (Long) lSession.getAttribute(ApplicationConstants.KEY_BANDWIDTH_LIMIT_LAST_RESET_TIME);
	long ljCurrentTimeMillis = System.currentTimeMillis();
	if (ljCurrentTimeMillis - ljLastResetTimeMillis < 1000) {
		return false;// Limit bandwidth per second.
	}

	lSession.setAttribute(ApplicationConstants.KEY_BANDWIDTH_LIMIT_LAST_RESET_TIME, ljCurrentTimeMillis);
	lSession.setAttribute(ApplicationConstants.KEY_BANDWIDTH_LIMIT_REMAINING_BYTES, BANDWIDTH);
	return true;
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
/**
 * Handles two cases: form submissions and showing a new form.
 * Delegates the decision between the two to {@link #isFormSubmission},
 * always treating requests without existing form session attribute
 * as new form when using session form mode.
 * @see #isFormSubmission
 * @see #showNewForm
 * @see #processFormSubmission
 */
@Override
protected ModelAndView handleRequestInternal(HttpServletRequest request, HttpServletResponse response) throws Exception {
	
	// Form submission or new form to show?
	if (isFormSubmission(request)) {
		// Fetch form object from HTTP session, bind, validate, process submission.
		try {
			Object command = getCommand(request);
			ServletRequestDataBinder binder = bindAndValidate(request, command);
			BindException errors = new BindException(binder.getBindingResult());
			return processFormSubmission(request, response, command, errors);
		}
		catch (HttpSessionRequiredException ex) {
			// Cannot submit a session form if no form object is in the session.
			if (logger.isDebugEnabled()) {
				logger.debug("Invalid submit detected: " + ex.getMessage());
			}
			return handleInvalidSubmit(request, response);
		}
	}

	else {
		// New form to show: render form view.
		return showNewForm(request, response);
	}
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
/**
 * Return the form object for the given request.
 * <p>Calls {@link #formBackingObject} if not in session form mode.
 * Else, retrieves the form object from the session. Note that the form object
 * gets removed from the session, but it will be re-added when showing the
 * form for resubmission.
 * @param request current HTTP request
 * @return object form to bind onto
 * @throws org.springframework.web.HttpSessionRequiredException
 * if a session was expected but no active session (or session form object) found
 * @throws Exception in case of invalid state or arguments
 * @see #formBackingObject
 */
@Override
protected final Object getCommand(HttpServletRequest request) throws Exception {
	// If not in session-form mode, create a new form-backing object.
	if (!isSessionForm()) {
		return formBackingObject(request);
	}
	
	// Session-form mode: retrieve form object from HTTP session attribute.
	HttpSession session = request.getSession(false);
	if (session == null) {
		throw new HttpSessionRequiredException("Must have session when trying to bind (in session-form mode)");
	}
	String formAttrName = getFormSessionAttributeName(request);
	Object sessionFormObject = session.getAttribute(formAttrName);
	if (sessionFormObject == null) {
		throw new HttpSessionRequiredException("Form object not found in session (in session-form mode)");
	}
	
	// Remove form object from HTTP session: we might finish the form workflow
	// in this request. If it turns out that we need to show the form view again,
	// we'll re-bind the form object to the HTTP session.
	if (logger.isDebugEnabled()) {
		logger.debug("Removing form session attribute [" + formAttrName + "]");
	}
	session.removeAttribute(formAttrName);
	
	return currentFormObject(request, sessionFormObject);
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
/**
 * Handles two cases: form submissions and showing a new form.
 * Delegates the decision between the two to {@link #isFormSubmission},
 * always treating requests without existing form session attribute
 * as new form when using session form mode.
 * @see #isFormSubmission
 * @see #showNewForm
 * @see #processFormSubmission
 */
@Override
protected ModelAndView handleRequestInternal(HttpServletRequest request, HttpServletResponse response)
		throws Exception {

	// Form submission or new form to show?
	if (isFormSubmission(request)) {
		// Fetch form object from HTTP session, bind, validate, process submission.
		try {
			Object command = getCommand(request);
			ServletRequestDataBinder binder = bindAndValidate(request, command);
			BindException errors = new BindException(binder.getBindingResult());
			return processFormSubmission(request, response, command, errors);
		}
		catch (HttpSessionRequiredException ex) {
			// Cannot submit a session form if no form object is in the session.
			if (logger.isDebugEnabled()) {
				logger.debug("Invalid submit detected: " + ex.getMessage());
			}
			return handleInvalidSubmit(request, response);
		}
	}

	else {
		// New form to show: render form view.
		return showNewForm(request, response);
	}
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
/**
 * Return the form object for the given request.
 * <p>Calls {@link #formBackingObject} if not in session form mode.
 * Else, retrieves the form object from the session. Note that the form object
 * gets removed from the session, but it will be re-added when showing the
 * form for resubmission.
 * @param request current HTTP request
 * @return object form to bind onto
 * @throws org.springframework.web.HttpSessionRequiredException
 * if a session was expected but no active session (or session form object) found
 * @throws Exception in case of invalid state or arguments
 * @see #formBackingObject
 */
@Override
protected final Object getCommand(HttpServletRequest request) throws Exception {
	// If not in session-form mode, create a new form-backing object.
	if (!isSessionForm()) {
		return formBackingObject(request);
	}

	// Session-form mode: retrieve form object from HTTP session attribute.
	HttpSession session = request.getSession(false);
	if (session == null) {
		throw new HttpSessionRequiredException("Must have session when trying to bind (in session-form mode)");
	}
	String formAttrName = getFormSessionAttributeName(request);
	Object sessionFormObject = session.getAttribute(formAttrName);
	if (sessionFormObject == null) {
		throw new HttpSessionRequiredException("Form object not found in session (in session-form mode)");
	}

	// Remove form object from HTTP session: we might finish the form workflow
	// in this request. If it turns out that we need to show the form view again,
	// we'll re-bind the form object to the HTTP session.
	if (logger.isDebugEnabled()) {
		logger.debug("Removing form session attribute [" + formAttrName + "]");
	}
	session.removeAttribute(formAttrName);

	return currentFormObject(request, sessionFormObject);
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
@Test
public void requiredSessionAttribute() throws Exception {
	ModelFactory modelFactory = new ModelFactory(null, null, sessionAttrsHandler);

	try {
		modelFactory.initModel(webRequest, new ModelAndViewContainer(), handleSessionAttrMethod);
		fail("Expected HttpSessionRequiredException");
	} catch (HttpSessionRequiredException e) { }

	sessionAttributeStore.storeAttribute(webRequest, "sessionAttr", "sessionAttrValue");
	ModelAndViewContainer mavContainer = new ModelAndViewContainer();
	modelFactory.initModel(webRequest, mavContainer, handleSessionAttrMethod);

	assertEquals("sessionAttrValue", mavContainer.getModel().get("sessionAttr"));
}
 

import org.springframework.web.HttpSessionRequiredException; //导入依赖的package包/类
@ExceptionHandler(HttpSessionRequiredException.class)
public ModelAndView handleHttpSessionRequiredException(HttpSessionRequiredException e, ServletWebRequest webRequest)
		throws Exception {
	logger.info("Handling Session required error: " + e.getMessage());
	return handleException(new AccessDeniedException("Could not obtain authorization request from session", e),
			webRequest);
}