Spring会话存储在DB Spring安全认证，集群环境中

我在Spring 4上有一个应用程序，具有Spring身份验证的安全性，以及spring会话以在群集环境中共享会话 .

我从Spring Session实现了sessionRepository以将会话存储在数据库中，所以当我进入站点spring会话时，创建一个名为“SESSION”的cookie并将其存储在DB上 .

这个session-DB实现的想法在这里：

How can I do relational database-based HTTP Session Persistence in Spring 4?

这时我有一个 Cookies “SESSION” . 当我在网站上登录时，spring security会创建另一个cookie“JSESSION”，但这不存储在数据库中，并且此cookie具有“身份验证信息” .

我的问题是：这种实施对于集群环境是否正确？或者我需要再做一次修改？

提前致谢 .

编辑2：

我最近测试了我的应用程序，我对我的解释犯了一个错误，当我进入网站时，我有一个cookie“SESSION”，即使我登录“SESSION”cookie剧照，但是没有其他cookie，如果我清理会话表并刷新用户注销的站点 . 这是正确的行为吗？

编辑：

这是我在SecurityConfig中的“配置”（从WebSecurityConfigurerAdapter扩展） .

@Override
protected void configure(final HttpSecurity http) throws Exception {
    // @formatter:off
    http
        //.csrf().disable()
        .authorizeRequests()
        .antMatchers(
                "/login*",
                "/logout*",
                "/forgotPassword*",
                "/user/initResetPassword*",
                "/user/resetPassword*",
                "/admin/saveConfiguration",
                "/resources/**"
        ).permitAll()
        .antMatchers("/invalidSession*").anonymous()
        .anyRequest().authenticated()
    .and()
        .formLogin()
        .loginPage("/login.html")
        .loginProcessingUrl("/login")
        .defaultSuccessUrl("/homepage.html")
        .failureUrl("/login.html?error=true")
        .successHandler(myAuthenticationSuccessHandler)
        .usernameParameter("username")
        .passwordParameter("password")
        .permitAll()
    .and()
        .addFilterBefore(this.sessionSessionRepositoryFilter, ChannelProcessingFilter.class)
        .sessionManagement()
        .invalidSessionUrl("/login.html")
        .sessionFixation()
        .migrateSession()
    .and()
        .logout()
        .invalidateHttpSession(false)
        .logoutUrl("/vu_logout")
        .logoutSuccessUrl("/logout.html?ls=true")
        .deleteCookies("JSESSION")
        .logoutSuccessHandler(mySimpleUrlLogoutSuccessHandler)
        .permitAll();
    // @formatter:on
}

我的登录成功处理程序：

@Component("myAuthenticationSuccessHandler")
public class MySimpleUrlAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
private final Logger LOGGER = LoggerFactory.getLogger(getClass());

private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException {
    handle(request, response, authentication);
    HttpSession session = request.getSession(false);

    if (session != null) {
        session.setMaxInactiveInterval(60 * 10);
    }
    clearAuthenticationAttributes(request);
}

protected void handle(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException {
    String targetUrl = determineTargetUrl(authentication);

    if (response.isCommitted()) {
        return;
    }

    redirectStrategy.sendRedirect(request, response, targetUrl);
}

protected String determineTargetUrl(Authentication authentication) {
    boolean isUser = false;
    boolean isAdmin = false;
    Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
    for (GrantedAuthority grantedAuthority : authorities) {
        if (grantedAuthority.getAuthority().equals("OPER") || grantedAuthority.getAuthority().equals("AUDITOR")) {
            isUser = true;
        } else if (grantedAuthority.getAuthority().equals("ADMIN")) {
            isAdmin = true;
            isUser = false;
            break;
        }
    }

    if(isUser || isAdmin)
    {
        return "/home.html";
    }
    else
    {
        throw new IllegalStateException();
    }
}

protected void clearAuthenticationAttributes(HttpServletRequest request) {
    HttpSession session = request.getSession(false);
    if (session == null) {
        return;
    }
    session.removeAttribute(WebAttributes.AUTHENTICATION_EXCEPTION);
}

public void setRedirectStrategy(RedirectStrategy redirectStrategy) {
    this.redirectStrategy = redirectStrategy;
}

protected RedirectStrategy getRedirectStrategy() {
    return redirectStrategy;
}

}