Cookie 与 Session：登录状态如何串起请求

import java.util.*;
public class Main {
  record UserDTO(long id,String name) {}
  record Entry(UserDTO user,long expires) {}
  static class Sessions {
    final Map<String,Entry> data=new HashMap<>();
    final long ttl; long lastTime=0;
    Sessions(long ttl) { if(ttl<=0) throw new IllegalArgumentException(); this.ttl=ttl; }
    void time(long now) { if(now<lastTime) throw new IllegalArgumentException("时钟回退"); lastTime=now; }
    long deadline(long now) { return Math.addExact(now,ttl); }
    void id(String id) { if(id==null || id.isBlank()) throw new IllegalArgumentException(); }
    Entry active(String id,long now) {
      Entry e=data.get(id);
      if(e!=null && now>=e.expires()) { data.remove(id); return null; } // 到期先失效
      return e;
    }
    synchronized void create(String id,UserDTO user,long now) {
      id(id); time(now); Objects.requireNonNull(user);
      if(active(id,now)!=null) throw new IllegalArgumentException("ID 冲突");
      data.put(id,new Entry(user,deadline(now)));
    }
    synchronized UserDTO get(String id,long now) {
      id(id); time(now); Entry old=active(id,now);
      if(old==null) return null;
      data.put(id,new Entry(old.user(),deadline(now))); // 仅有效访问延长闲置期
      return old.user();
    }
    synchronized boolean rotate(String oldId,String newId,long now) {
      id(oldId); id(newId); time(now);
      if(oldId.equals(newId)) throw new IllegalArgumentException("必须更换标识");
      Entry old=active(oldId,now); if(old==null) return false;
      if(active(newId,now)!=null) throw new IllegalArgumentException("目标冲突");
      Entry fresh=new Entry(old.user(),deadline(now)); // 所有可能失败的检查在删除前
      data.remove(oldId); data.put(newId,fresh);
      return true;
    }
  }
  static void check(boolean ok) { if(!ok) throw new AssertionError(); }
  public static void main(String[] args) {
    UserDTO user=new UserDTO(7,"Alice");
    Sessions rotate=new Sessions(10); rotate.create("old",user,0);
    check(rotate.rotate("old","fresh",1)); check(rotate.get("old",1)==null);
    check(rotate.get("fresh",1).equals(user));
    Sessions idle=new Sessions(10); idle.create("x",user,0);
    check(idle.get("x",9)!=null); check(idle.get("x",18)!=null);
    Sessions expired=new Sessions(10); expired.create("x",user,0); check(expired.get("x",10)==null);
    check(!expired.rotate("x","y",11));
    Sessions conflict=new Sessions(10); conflict.create("a",user,0); conflict.create("b",user,0);
    try { conflict.rotate("a","b",1); throw new AssertionError("应拒绝冲突"); }
    catch(IllegalArgumentException expected) { /* 原会话应仍保留 */ }
    check(conflict.get("a",1)!=null && conflict.get("b",1)!=null);
    try { idle.get("x",17); throw new AssertionError("应拒绝时间回退"); }
    catch(IllegalArgumentException expected) { /* 非递减时钟约束 */ }
    System.out.println("PASS 10 session assertions");
  }
}