Databases
StackOverflow2013
Postsdbo
POMy different sessions are being duplicated with the same last activity and session id, why?
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POMy different sessions are being duplicated with the same last activity and session id, why?
    text
    copied!<p>I'm using spring security, when i log in from different browsers with the same user (which i set to be possible to have multiple sessions), the data passed from the controller (where i get the SessionInformation from every principal) to the View is being duplicated instead of creating a new Session Id and the Last Activity is the very same for all the different browser sessions as well. </p> <p>This is a part of the spring-security.xml where the sessionRegistry is configured and stuff. <br> </p> <pre><code> &lt;form-login login-page="/login" default-target-url="/welcome" always-use-default-target="true" authentication-failure-url="/loginfailed"/&gt; &lt;logout logout-success-url="/logout" /&gt; &lt;custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" /&gt; &lt;custom-filter after="FORM_LOGIN_FILTER" ref="myAuthFilter" /&gt; &lt;session-management session-authentication-strategy-ref="sas"/&gt; &lt;/http&gt; &lt;authentication-manager alias="authenticationManager"&gt; &lt;authentication-provider ref="ldapAuthProvider"&gt; &lt;/authentication-provider&gt; &lt;/authentication-manager&gt; &lt;beans:bean id="concurrencyFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter"&gt; &lt;beans:property name="sessionRegistry" ref="sessionRegistry" /&gt; &lt;/beans:bean&gt; &lt;beans:bean id="myAuthFilter" class= "org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"&gt; &lt;beans:property name="sessionAuthenticationStrategy" ref="sas" /&gt; &lt;beans:property name="authenticationManager" ref="authenticationManager" /&gt; &lt;/beans:bean&gt; &lt;beans:bean id="sas" class= "org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy"&gt; &lt;beans:constructor-arg name="sessionRegistry" ref="sessionRegistry" /&gt; &lt;beans:property name="maximumSessions" value="-1" /&gt; &lt;/beans:bean&gt; &lt;beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" /&gt; </code></pre> <p>This is the Controller on which the sessionRegistry is being consumed:</p> <pre><code>@RequestMapping(value = "/activeusers", method = RequestMethod.GET) public String manageActiveUsers(ModelMap model, Principal principal) { String name = principal.getName(); model.addAttribute("username", name); List&lt;LoginUserInfo&gt; userSessionData = new ArrayList&lt;LoginUserInfo&gt;(); List&lt;Object&gt; principals = sessionRegistry.getAllPrincipals(); //TODO: Find a better way to get the remote IP Address according to each client call String remoteAddress = ((ServletRequestAttributes)RequestContextHolder.currentRequestAttributes()) .getRequest().getLocalAddr(); for (Object object : principals) { LoginUserInfo userInfo = new LoginUserInfo(); LdapUserDetailsImpl user = (LdapUserDetailsImpl) object; List&lt;SessionInformation&gt; sessions = sessionRegistry.getAllSessions(user, false); String username = user.getUsername(); for (SessionInformation session : sessions) { Date lastRequest = session.getLastRequest(); String sessionId = session.getSessionId(); userInfo.setUsername(username); userInfo.setIp(remoteAddress); userInfo.setLastActivity(lastRequest.getTime()); userInfo.setSessionId(sessionId); userSessionData.add(userInfo); } } model.addAttribute("userSessionData", userSessionData); return "activeusers"; } </code></pre> <p>And then i send "userSessionData" to a jsp VIEW like this.</p> <pre><code> &lt;c:forEach var="userDetail" items="${userSessionData}"&gt; &lt;tr&gt; &lt;td&gt;&lt;c:out value="${userDetail.ip}"/&gt;&lt;/td&gt; &lt;td&gt;&lt;c:out value="${userDetail.username}"/&gt;&lt;/td&gt; &lt;td&gt;&lt;c:out value="${userDetail.lastActivity}"/&gt;&lt;/td&gt; &lt;td&gt;&lt;c:out value="${userDetail.sessionId}"/&gt;&lt;/td&gt; &lt;/tr&gt; &lt;/c:forEach&gt; </code></pre> <p>As i said, all the user related data is being duplicated (sessionId and lastActivity) even though i log in from another browser. When i do some requests from one browser, the lastActivity gets refreshed in all the sessions at the same time. </p> <p>Another thing, when i log out from different browsers, the session should be terminated. But when i check the session List, is still there. Why is that happening too???</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload