refactor: 调整session过期时间为可配置，默认1800s

backend/src/main/java/io/metersphere/config/ShiroConfig.java

@@ -14,11 +14,13 @@ import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
 import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
 import org.springframework.boot.web.servlet.FilterRegistrationBean;
 import org.springframework.context.ApplicationContext;
+import org.springframework.context.EnvironmentAware;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.DependsOn;
 import org.springframework.context.event.ContextRefreshedEvent;
 import org.springframework.context.event.EventListener;
+import org.springframework.core.env.Environment;
 
 import javax.servlet.DispatcherType;
 import javax.servlet.Filter;
@@ -27,7 +29,8 @@ import java.util.Map;
 import java.util.Objects;
 
 @Configuration
-public class ShiroConfig {
+public class ShiroConfig implements EnvironmentAware {
+    private Environment env;
 
     @Bean
     public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager sessionManager) {
@@ -115,9 +118,11 @@ public class ShiroConfig {
 
     @Bean
     public SessionManager sessionManager(MemoryConstrainedCacheManager memoryConstrainedCacheManager) {
+        Long sessionTimeout = env.getProperty("session.timeout", Long.class, 1800L); // 默认1800s, 半个小时
+
         DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
         sessionManager.setSessionIdUrlRewritingEnabled(false);
-        sessionManager.setGlobalSessionTimeout(1800000L);
+        sessionManager.setGlobalSessionTimeout(sessionTimeout * 1000);// 超时时间ms
         sessionManager.setDeleteInvalidSessions(true);
         sessionManager.setSessionValidationSchedulerEnabled(true);
         SimpleCookie sessionIdCookie = new SimpleCookie();
@@ -137,4 +142,9 @@ public class ShiroConfig {
         ShiroDBRealm shiroDBRealm = (ShiroDBRealm) context.getBean("shiroDBRealm");
         ((DefaultWebSecurityManager) context.getBean("securityManager")).setRealm(shiroDBRealm);
     }
+
+    @Override
+    public void setEnvironment(Environment environment) {
+        this.env = environment;
+    }
 }