How to access session attributes in LogoutSuccessHandler?

Question

In a Spring MVC application I am trying to implement a custom logout success handler. This handler should access a session attribute and make some queries and logging bases on its value.

Relevant parts of the implementation:

1. Security configuration:

<http ...> <logout success-handler-ref="logoutSuccessHandler"/> </http>

<beans:bean id="logoutSuccessHandler" class="some.package.LogoutSuccessHandler">
    <beans:constructor-arg value="/login" />
</beans:bean>

2. The handler itself:

public class LogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {

    @Autowired
    private SomeService someService;

    public LogoutSuccessHandler(String defaultTargetUrl) {
        this.setDefaultTargetUrl(defaultTargetUrl);
    }

    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)
            throws IOException, ServletException {
        String sessionAttribute = request.getSession().getAttribute("someAttribute").toString();
        someService.doSomething(sessionAttribute);
        super.onLogoutSuccess(request, response, authentication);
    }
}

I am adding some attributes to the session when a user logs in. They are visible during different controller requests. The problem is, when I try to access session attributes during logout, they are all gone. Does that mean that by that time the logout has already taken place and session information is wiped out? I can see that SessionId is the same as before though.

So, my question is: what happens to the session attributes and is there a way to access them in LogoutSuccessHandler?

Answer 1

<logout success-handler-ref="logoutSuccessHandler" invalidate-session="false"/>

the default value of invalidate-session is true, so you will get a new session in your handler.

When you set this value to false, then you can get the old session, and don't forget to invalidate session after you finished your business.