spring-security.xml部分代碼：

    <http auto-config="false" >
        <access-denied-handler ref="accessDeniedHandler" />
        <!-- 
        <form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=1" default-target-url="/" always-use-default-target="true" />
        
 
-->
        <http-basic />
        <custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" />
        <custom-filter ref="loginFilter" before="FORM_LOGIN_FILTER" />
        <!-- 替換默認的LogoutFilter <logout logout-success-url="/login.jsp" /> -->
        <
 
custom-filter ref="ylLogoutFilter" before="LOGOUT_FILTER" />
        <custom-filter ref="logoutFilter" position="LOGOUT_FILTER" />
        <custom-filter ref="carParkLogoutFilter" after="LOGOUT_FILTER" />
        <!-- 增加一個自定義的customSecurityInterceptor，放在FILTER_SECURITY_INTERCEPTOR之前， 實現用戶、角色、權限、資源的數據庫管理。 
 
--> 
        <custom-filter ref="customSecurityInterceptor" before="FILTER_SECURITY_INTERCEPTOR" />
        <remember-me />
        <!-- 會話管理配置  -->
        <session-management session-authentication-strategy-ref="sessionAuthenticationStrategy" invalid-session-url="/logon/commonSessionExpired.htm"/>
    </http>
    <beans:bean id="concurrencyFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter">  
        <beans:property name="sessionRegistry" ref="sessionRegistry" />  
        <beans:property name="expiredUrl" value="/logon/commonSessionExpired.htm" />  
    </beans:bean>

攔截過期：spring-mvc.xml 這裏主要是為了彈窗口，不彈窗口就不用做下面了

    <mvc:interceptors>
        <!-- 特定路徑下才攔截 -->
        <mvc:interceptor>
            <mvc:mapping path="/logon/commonSessionExpired.htm"/>
            <bean class="com.jevon.frame.security.SessionInterceptor"/> 
        </mvc:interceptor> 
    </mvc:interceptors>

攔截器：SessionInterceptor, 這裏需要區分ajax請求，和普通請求，ajax返回需要轉換成JSON格式的，這裏ReturnResult使用Map代替就可以了

package com.jevon.frame.security;
import java.io.PrintWriter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
import com.jevon.can.common.domain.ReturnResult;
import net.sf.json.JSONObject;

public class SessionInterceptor extends HandlerInterceptorAdapter {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
            throws Exception {
            request.setCharacterEncoding("UTF-8");
            response.setCharacterEncoding("UTF-8");
            response.setContentType("text/html;charset=UTF-8");
            /**
            String url = request.getServletPath();
            if (url != null && url.contains("/logon/expiredUrl")) {
                return Boolean.TRUE;
            }**/
            if (null == request.getSession().getAttribute("SES_CURRENTUSER")) {
                if(isAjax(request)){
                    PrintWriter out = response.getWriter();
                    JSONObject jsonObject = JSONObject.fromObject(new ReturnResult("頁面過期，請重新登錄！", "logout", false));
                    out.print(jsonObject);
                    out.close();
                }else{
                    PrintWriter out = response.getWriter();
                    StringBuilder builder = new StringBuilder();
                    builder.append("<script type=\"text/javascript\" charset=\"UTF-8\">");
                    builder.append("window.top.logoutAlert(\"頁面過期，請重新登錄!\");");//alert(\"頁面過期，請重新登錄!\");");
                    builder.append("</script>");
                    out.print(builder.toString());
                    out.close();
                }
                return false;
            } 
        return true;
    }
    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
            ModelAndView modelAndView) throws Exception {
        super.postHandle(request, response, handler, modelAndView);
    }
    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
            throws Exception {
        // TODO Auto-generated method stub
        super.afterCompletion(request, response, handler, ex);
    }
    
    //判斷是否ajax請求
    public static boolean isAjax(HttpServletRequest request) {  
         return "XMLHttpRequest".equals(request.getHeader("X-Requested-With"));  
    }  
}

封裝的ajax.js返回：這裏使用的是logout類型

        loadComplete: function (data) {
            if (data.success === false) {
                if (data.msgType == ‘1‘) {
                    window.parent.location = $.getProjectName() + ‘/logon/commonQuit.htm‘;
                }
                if (data.msgType == ‘2‘ && data.msg) {
                    $.messager.alert("警告", data.msg, "warning");
                }
                if (data.msgType == ‘3‘ && data.msg) {
                    $.messager.alert("錯誤", data.msg, "error");
                }
                if(data.msgType == ‘logout‘) {
                    $.messager.alert("警告", data.msg, "info", function(r) {
                        window.parent.location = $.getProjectName() + ‘/logon/expiredUrl.htm‘;
                    });
                }
            }
        }

最頂層jsp頁面：攔截器直接調用該方法，alert 就可以使用到樣式

<script>
     function logoutAlert(msg) {
        $.messager.alert("警告", msg, "info", function(r) {
             window.location = $.getProjectName() + ‘/logon/expiredUrl.htm‘;
        });
    }
</script>

spring security 單一賬戶多地方登陸提醒, ajax 攔截器 Interceptor