Search code examples
servletsspring-securitytomcat7httpsession

Programmatic invalidation of HttpSession

Is it possible to terminate a logged in user's HttpSession?

We can do the following from within the user's session:

HttpSession s = request.getSession(false);
s.invalidate(); // make sure s != null

But how can an Admin-User 'kick-out' a given user?

I was hoping to find some API under ServletContext which would return a list of active sessions, but that doesn't appear to be the case.

I'm using Spring Security 3 & Tomcat 7.

Solution

  • Spring Security has a SessionRegistry in order to handle this kind of scenarios. You can declare it using session-registry-ref attribute in concurrency-control tag. Here you have a little documentation.