RedisHttpSession反序列化UID问题跟踪

2024-04-20 08:44
文章标签 问题 序列化 跟踪 uid redishttpsession

本文主要是介绍RedisHttpSession反序列化UID问题跟踪，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

1.RedisHttpSession配置
package com.visy.configure;import org.springframework.context.annotation.Configuration;
import org.springframework.session.data.redis.config.annotation.web.http.EnableRedisHttpSession;@Configuration
@EnableRedisHttpSession(maxInactiveIntervalInSeconds=100)
public class ConfigRedisSession {}
2.报错信息：
org.springframework.data.redis.serializer.SerializationException: Cannot deserialize;
nested exception is org.springframework.core.serializer.support.SerializationFailedException: 
Failed to deserialize payload. Is the byte array a result of corresponding serialization for DefaultDeserializer?; 
nested exception is java.io.InvalidClassException:
com.vz.common.model.User;
local class incompatible: stream classdesc serialVersionUID = 1, local class serialVersionUID = -6369326306393228118
3.问题跟踪
  • 注解源码
package org.springframework.session.data.redis.config.annotation.web.http;@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.TYPE})
@Documented
@Import({RedisHttpSessionConfiguration.class})
@Configuration
public @interface EnableRedisHttpSession {int maxInactiveIntervalInSeconds() default 1800;String redisNamespace() default "";RedisFlushMode redisFlushMode() default RedisFlushMode.ON_SAVE;
}
  • Redis序列化器配置
package org.springframework.session.data.redis.config.annotation.web.http;@Configuration
@EnableScheduling
public class RedisHttpSessionConfiguration extends SpringHttpSessionConfiguration implements EmbeddedValueResolverAware, ImportAware {private Integer maxInactiveIntervalInSeconds = 1800;private ConfigureRedisAction configureRedisAction = new ConfigureNotifyKeyspaceEventsAction();private String redisNamespace = "";private RedisFlushMode redisFlushMode;private RedisSerializer<Object> defaultRedisSerializer;private Executor redisTaskExecutor;private Executor redisSubscriptionExecutor;private StringValueResolver embeddedValueResolver;public RedisHttpSessionConfiguration() {this.redisFlushMode = RedisFlushMode.ON_SAVE;}@Beanpublic RedisTemplate<Object, Object> sessionRedisTemplate(RedisConnectionFactory connectionFactory) {RedisTemplate<Object, Object> template = new RedisTemplate();template.setKeySerializer(new StringRedisSerializer());template.setHashKeySerializer(new StringRedisSerializer());if (this.defaultRedisSerializer != null) {//如果存在默认序列化器则使用template.setDefaultSerializer(this.defaultRedisSerializer);}template.setConnectionFactory(connectionFactory);return template;}//设置默认序列化器，寻找名称为”springSessionDefaultRedisSerializer“的RedisSerializer注入@Autowired( required = false)@Qualifier("springSessionDefaultRedisSerializer")public void setDefaultRedisSerializer(RedisSerializer<Object> defaultRedisSerializer) {this.defaultRedisSerializer = defaultRedisSerializer;}
}
  • 默认序列化器的默认值
package org.springframework.data.redis.core;public class RedisTemplate<K, V> extends RedisAccessor implements RedisOperations<K, V>, BeanClassLoaderAware {public void afterPropertiesSet() {super.afterPropertiesSet();boolean defaultUsed = false;if (this.defaultSerializer == null) {//默认序列化器是JdkSerializationRedisSerializerthis.defaultSerializer = new JdkSerializationRedisSerializer(this.classLoader != null ? this.classLoader : this.getClass().getClassLoader());}if (this.enableDefaultSerializer) {if (this.keySerializer == null) {this.keySerializer = this.defaultSerializer;defaultUsed = true;}if (this.valueSerializer == null) {this.valueSerializer = this.defaultSerializer;defaultUsed = true;}if (this.hashKeySerializer == null) {this.hashKeySerializer = this.defaultSerializer;defaultUsed = true;}if (this.hashValueSerializer == null) {this.hashValueSerializer = this.defaultSerializer;defaultUsed = true;}}if (this.enableDefaultSerializer && defaultUsed) {Assert.notNull(this.defaultSerializer, "default serializer null and not all serializers initialized");}if (this.scriptExecutor == null) {this.scriptExecutor = new DefaultScriptExecutor(this);}this.initialized = true;}
}
  • 反序列化过程

默认使用JdkSerializationRedisSerializer反序列化的过程

package org.springframework.data.redis.serializer;public class JdkSerializationRedisSerializer implements RedisSerializer<Object> {public Object deserialize(byte[] bytes) {if (SerializationUtils.isEmpty(bytes)) {return null;} else {try {//反序列化return this.deserializer.convert(bytes);} catch (Exception var3) {throw new SerializationException("Cannot deserialize", var3);}}}
}

package org.springframework.core.serializer.support;public class DeserializingConverter implements Converter<byte[], Object> {public Object convert(byte[] source) {ByteArrayInputStream byteStream = new ByteArrayInputStream(source);try {//反序列化return this.deserializer.deserialize(byteStream);} catch (Throwable var4) {throw new SerializationFailedException("Failed to deserialize payload. Is the byte array a result of corresponding serialization for " + this.deserializer.getClass().getSimpleName() + "?", var4);}}
}

package org.springframework.core.serializer;public class DefaultDeserializer implements Deserializer<Object> {public Object deserialize(InputStream inputStream) throws IOException {ObjectInputStream objectInputStream = new ConfigurableObjectInputStream(inputStream, this.classLoader);try {//读取对象return objectInputStream.readObject();} catch (ClassNotFoundException var4) {throw new NestedIOException("Failed to deserialize object type", var4);}}
}

package java.io;public class ObjectInputStream extends InputStream implements ObjectInput, ObjectStreamConstants {public final Object readObject()throws IOException, ClassNotFoundException {return readObject(Object.class);}private final Object readObject(Class<?> type) throws IOException, ClassNotFoundException {if (enableOverride) {return readObjectOverride();}if (! (type == Object.class || type == String.class))throw new AssertionError("internal error");// if nested read, passHandle contains handle of enclosing objectint outerHandle = passHandle;try {Object obj = readObject0(type, false);handles.markDependency(outerHandle, passHandle);ClassNotFoundException ex = handles.lookupException(passHandle);if (ex != null) {throw ex;}if (depth == 0) {vlist.doCallbacks();}return obj;} finally {passHandle = outerHandle;if (closed && depth == 0) {clear();}}}private Object readObject0(Class<?> type, boolean unshared) throws IOException {boolean oldMode = bin.getBlockDataMode();if (oldMode) {int remain = bin.currentBlockRemaining();if (remain > 0) {throw new OptionalDataException(remain);} else if (defaultDataEnd) {/** Fix for 4360508: stream is currently at the end of a field* value block written via default serialization; since there* is no terminating TC_ENDBLOCKDATA tag, simulate* end-of-custom-data behavior explicitly.*/throw new OptionalDataException(true);}bin.setBlockDataMode(false);}byte tc;while ((tc = bin.peekByte()) == TC_RESET) {bin.readByte();handleReset();}depth++;totalObjectRefs++;try {switch (tc) {case TC_NULL:return readNull();case TC_REFERENCE:// check the type of the existing objectreturn type.cast(readHandle(unshared));case TC_CLASS:if (type == String.class) {throw new ClassCastException("Cannot cast a class to java.lang.String");}return readClass(unshared);case TC_CLASSDESC:case TC_PROXYCLASSDESC:if (type == String.class) {throw new ClassCastException("Cannot cast a class to java.lang.String");}return readClassDesc(unshared);case TC_STRING:case TC_LONGSTRING:return checkResolve(readString(unshared));case TC_ARRAY:if (type == String.class) {throw new ClassCastException("Cannot cast an array to java.lang.String");}return checkResolve(readArray(unshared));case TC_ENUM:if (type == String.class) {throw new ClassCastException("Cannot cast an enum to java.lang.String");}return checkResolve(readEnum(unshared));case TC_OBJECT:if (type == String.class) {throw new ClassCastException("Cannot cast an object to java.lang.String");}return checkResolve(readOrdinaryObject(unshared));case TC_EXCEPTION:if (type == String.class) {throw new ClassCastException("Cannot cast an exception to java.lang.String");}IOException ex = readFatalException();throw new WriteAbortedException("writing aborted", ex);case TC_BLOCKDATA:case TC_BLOCKDATALONG:if (oldMode) {bin.setBlockDataMode(true);bin.peek();             // force header readthrow new OptionalDataException(bin.currentBlockRemaining());} else {throw new StreamCorruptedException("unexpected block data");}case TC_ENDBLOCKDATA:if (oldMode) {throw new OptionalDataException(true);} else {throw new StreamCorruptedException("unexpected end of block data");}default:throw new StreamCorruptedException(String.format("invalid type code: %02X", tc));}} finally {depth--;bin.setBlockDataMode(oldMode);}}private ObjectStreamClass readClassDesc(boolean unshared) throws IOException {byte tc = bin.peekByte();ObjectStreamClass descriptor;switch (tc) {case TC_NULL:descriptor = (ObjectStreamClass) readNull();break;case TC_REFERENCE:descriptor = (ObjectStreamClass) readHandle(unshared);// Should only reference initialized class descriptorsdescriptor.checkInitialized();break;case TC_PROXYCLASSDESC:descriptor = readProxyDesc(unshared);break;case TC_CLASSDESC:descriptor = readNonProxyDesc(unshared);break;default:throw new StreamCorruptedException(String.format("invalid type code: %02X", tc));}if (descriptor != null) {validateDescriptor(descriptor);}return descriptor;}private ObjectStreamClass readNonProxyDesc(boolean unshared) throws IOException {if (bin.readByte() != TC_CLASSDESC) {throw new InternalError();}ObjectStreamClass desc = new ObjectStreamClass();int descHandle = handles.assign(unshared ? unsharedMarker : desc);passHandle = NULL_HANDLE;ObjectStreamClass readDesc = null;try {readDesc = readClassDescriptor();} catch (ClassNotFoundException ex) {throw (IOException) new InvalidClassException("failed to read class descriptor").initCause(ex);}Class<?> cl = null;ClassNotFoundException resolveEx = null;bin.setBlockDataMode(true);final boolean checksRequired = isCustomSubclass();try {if ((cl = resolveClass(readDesc)) == null) {resolveEx = new ClassNotFoundException("null class");} else if (checksRequired) {ReflectUtil.checkPackageAccess(cl);}} catch (ClassNotFoundException ex) {resolveEx = ex;}// Call filterCheck on the class before reading anything elsefilterCheck(cl, -1);skipCustomData();try {totalObjectRefs++;depth++;desc.initNonProxy(readDesc, cl, resolveEx, readClassDesc(false));} finally {depth--;}handles.finish(descHandle);passHandle = descHandle;return desc;}
}

package java.io;public class ObjectStreamClass implements Serializable {void initNonProxy(ObjectStreamClass model,Class<?> cl,ClassNotFoundException resolveEx,ObjectStreamClass superDesc)throws InvalidClassException{long suid = Long.valueOf(model.getSerialVersionUID());ObjectStreamClass osc = null;if (cl != null) {osc = lookup(cl, true);if (osc.isProxy) {throw new InvalidClassException("cannot bind non-proxy descriptor to a proxy class");}if (model.isEnum != osc.isEnum) {throw new InvalidClassException(model.isEnum ?"cannot bind enum descriptor to a non-enum class" :"cannot bind non-enum descriptor to an enum class");}if (model.serializable == osc.serializable &&!cl.isArray() &&suid != osc.getSerialVersionUID()) {throw new InvalidClassException(osc.name,"local class incompatible: " +"stream classdesc serialVersionUID = " + suid +", local class serialVersionUID = " +osc.getSerialVersionUID());}if (!classNamesEqual(model.name, osc.name)) {throw new InvalidClassException(osc.name,"local class name incompatible with stream class " +"name \"" + model.name + "\"");}if (!model.isEnum) {if ((model.serializable == osc.serializable) &&(model.externalizable != osc.externalizable)) {throw new InvalidClassException(osc.name,"Serializable incompatible with Externalizable");}if ((model.serializable != osc.serializable) ||(model.externalizable != osc.externalizable) ||!(model.serializable || model.externalizable)) {deserializeEx = new ExceptionInfo(osc.name, "class invalid for deserialization");}}}this.cl = cl;this.resolveEx = resolveEx;this.superDesc = superDesc;name = model.name;this.suid = suid;isProxy = false;isEnum = model.isEnum;serializable = model.serializable;externalizable = model.externalizable;hasBlockExternalData = model.hasBlockExternalData;hasWriteObjectData = model.hasWriteObjectData;fields = model.fields;primDataSize = model.primDataSize;numObjFields = model.numObjFields;if (osc != null) {localDesc = osc;writeObjectMethod = localDesc.writeObjectMethod;readObjectMethod = localDesc.readObjectMethod;readObjectNoDataMethod = localDesc.readObjectNoDataMethod;writeReplaceMethod = localDesc.writeReplaceMethod;readResolveMethod = localDesc.readResolveMethod;if (deserializeEx == null) {deserializeEx = localDesc.deserializeEx;}domains = localDesc.domains;cons = localDesc.cons;}fieldRefl = getReflector(fields, localDesc);// reassign to matched fields so as to reflect local unshared settingsfields = fieldRefl.getFields();initialized = true;}
}
  • 报错来源
if (model.serializable == osc.serializable &&!cl.isArray() &&suid != osc.getSerialVersionUID()) {throw new InvalidClassException(osc.name,"local class incompatible: " +"stream classdesc serialVersionUID = " + suid +", local class serialVersionUID = " +osc.getSerialVersionUID());
}
4.解决方案

自定义一个序列化器，不要使用JdkSerializationRedisSerializer
以下是官方给出的自定义默认序列化器的配置方法，点击可查看

@Configuration
public class SessionConfig implements BeanClassLoaderAware {private ClassLoader loader;@Beanpublic RedisSerializer<Object> springSessionDefaultRedisSerializer() {//改用Jackson的序列化器return new GenericJackson2JsonRedisSerializer(objectMapper());}/*** Customized {@link ObjectMapper} to add mix-in for class that doesn't have default* constructors* @return the {@link ObjectMapper} to use*/private ObjectMapper objectMapper() {ObjectMapper mapper = new ObjectMapper();mapper.registerModules(SecurityJackson2Modules.getModules(this.loader));return mapper;}/** @see* org.springframework.beans.factory.BeanClassLoaderAware#setBeanClassLoader(java.lang* .ClassLoader)*/@Overridepublic void setBeanClassLoader(ClassLoader classLoader) {this.loader = classLoader;}}

这篇关于RedisHttpSession反序列化UID问题跟踪的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！


http://www.chinasem.cn/article/919801。

相关文章

SpringBoot启动报错的11个高频问题排查与解决终极指南

SpringBoot启动报错的11个高频问题排查与解决终极指南

《SpringBoot启动报错的11个高频问题排查与解决终极指南》这篇文章主要为大家详细介绍了SpringBoot启动报错的11个高频问题的排查与解决,文中的示例代码讲解详细,感兴趣的小伙伴可以了解一... 目录1. 依赖冲突：NoSuchMethodError 的终极解法2. Bean注入失败：No qu
阅读更多...
MySQL新增字段后Java实体未更新的潜在问题与解决方案

MySQL新增字段后Java实体未更新的潜在问题与解决方案

《MySQL新增字段后Java实体未更新的潜在问题与解决方案》在Java+MySQL的开发中,我们通常使用ORM框架来映射数据库表与Java对象,但有时候,数据库表结构变更（如新增字段）后,开发人员可... 目录引言1. 问题背景：数据库与 Java 实体不同步1.1 常见场景1.2 示例代码2. 不同操作
阅读更多...
Django序列化中SerializerMethodField的使用详解

Django序列化中SerializerMethodField的使用详解

《Django序列化中SerializerMethodField的使用详解》：本文主要介绍Django序列化中SerializerMethodField的使用,具有很好的参考价值,希望对大家有所帮... 目录SerializerMethodField的基本概念使用SerializerMethodField的
阅读更多...
如何解决mysql出现Incorrect string value for column ‘表项‘ at row 1错误问题

如何解决mysql出现Incorrect string value for column ‘表项‘ at row 1错误问题

《如何解决mysql出现Incorrectstringvalueforcolumn‘表项‘atrow1错误问题》：本文主要介绍如何解决mysql出现Incorrectstringv... 目录mysql出现Incorrect string value for column ‘表项‘ at row 1错误报错
阅读更多...
如何解决Spring MVC中响应乱码问题

如何解决Spring MVC中响应乱码问题

《如何解决SpringMVC中响应乱码问题》：本文主要介绍如何解决SpringMVC中响应乱码问题,具有很好的参考价值,希望对大家有所帮助,如有错误或未考虑完全的地方,望不吝赐教... 目录Spring MVC最新响应中乱码解决方式以前的解决办法这是比较通用的一种方法总结Spring MVC最新响应中乱码解
阅读更多...
pip无法安装osgeo失败的问题解决

pip无法安装osgeo失败的问题解决

《pip无法安装osgeo失败的问题解决》本文主要介绍了pip无法安装osgeo失败的问题解决,文中通过示例代码介绍的非常详细,对大家的学习或者工作具有一定的参考学习价值,需要的朋友们下面随着小编来一... 进入官方提供的扩展包下载网站寻找版本适配的whl文件注意：要选择cp（python版本）和你py
阅读更多...
解决Java中基于GeoTools的Shapefile读取乱码的问题

解决Java中基于GeoTools的Shapefile读取乱码的问题

《解决Java中基于GeoTools的Shapefile读取乱码的问题》本文主要讨论了在使用Java编程语言进行地理信息数据解析时遇到的Shapefile属性信息乱码问题,以及根据不同的编码设置进行属... 目录前言1、Shapefile属性字段编码的情况：一、Shp文件常见的字符集编码1、System编码
阅读更多...
Spring MVC使用视图解析的问题解读

Spring MVC使用视图解析的问题解读

《SpringMVC使用视图解析的问题解读》：本文主要介绍SpringMVC使用视图解析的问题解读,具有很好的参考价值,希望对大家有所帮助,如有错误或未考虑完全的地方,望不吝赐教... 目录Spring MVC使用视图解析1. 会使用视图解析的情况2. 不会使用视图解析的情况总结Spring MVC使用视图
阅读更多...
Redis解决缓存击穿问题的两种方法

Redis解决缓存击穿问题的两种方法

《Redis解决缓存击穿问题的两种方法》缓存击穿问题也叫热点Key问题,就是⼀个被高并发访问并且缓存重建业务较复杂的key突然失效了,无数的请求访问会在瞬间给数据库带来巨大的冲击,本文给大家介绍了Re... 目录引言解决办法互斥锁（强一致，性能差）逻辑过期（高可用，性能优）设计逻辑过期时间引言缓存击穿：给
阅读更多...
一文详解SQL Server如何跟踪自动统计信息更新

一文详解SQL Server如何跟踪自动统计信息更新

《一文详解SQLServer如何跟踪自动统计信息更新》SQLServer数据库中,我们都清楚统计信息对于优化器来说非常重要,所以本文就来和大家简单聊一聊SQLServer如何跟踪自动统计信息更新吧... SQL Server数据库中，我们都清楚统计信息对于优化器来说非常重要。一般情况下，我们会开启"自动更新
阅读更多...

Copyright China编程 23002807@qq.com

沪ICP备2023033072号-2