Databases
StackOverflow2013
Postsdbo
POHow Invalidate users sessions when makes logout?
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHow Invalidate users sessions when makes logout?
    text
    copied!<p>I spent a lot of time to solve this problem, yet still couldn't get it work.</p> <p>I am using Spring Security. The application will run on multiple servers. I use the option "remember me" on login to save persistent logins in my database.</p> <p>If a user is connected to server 1, he has a session id in cookies browser. I turn on another server and this user makes authentication and the cookies browser have this session id and the session id of server 1 connection.</p> <p>When this user logs out in one server or another server, he should be redirected to login page in all servers.</p> <p>I tried to remove cookies from browser without success. How can I make this work? Any help?</p> <p>Example scenario: In gmail, if you have 2 tabs open in your account and if you log out from one of them, other tab automatically logs out too. The server 1 doesn't know the information of server 2.. I think my problem is here but I don't know how I can solve this.</p> <p>This is my security config:</p> <pre><code>&lt;http auto-config="false" use-expressions="true" disable-url-rewriting="true"&gt; &lt;intercept-url pattern="/login.do" access="permitAll" /&gt; &lt;intercept-url pattern="/**" access="hasRole('ROLE_USER')" /&gt; &lt;remember-me data-source-ref="dataSource" /&gt; &lt;form-login login-page="/login.do" /&gt; &lt;custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" /&gt; &lt;custom-filter position="LOGOUT_FILTER" ref="logoutFilter" /&gt; &lt;session-management session-authentication-strategy-ref="sas" /&gt; &lt;/http&gt; &lt;!-- &lt;logout logout-url="/j_spring_security_logout" logout-success-url="/" invalidate-session="true" /&gt; --&gt; &lt;beans:bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter"&gt; &lt;beans:constructor-arg value="/login.do" /&gt; &lt;beans:constructor-arg&gt; &lt;beans:list&gt; &lt;beans:ref bean="rememberMeServices"/&gt; &lt;beans:ref bean="logoutHandler"/&gt; &lt;/beans:list&gt; &lt;/beans:constructor-arg&gt; &lt;!-- &lt;beans:property name="filterProcessesUrl" value="/login.do" /&gt; --&gt; &lt;/beans:bean&gt; &lt;beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" /&gt; &lt;beans:bean id="concurrencyFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter"&gt; &lt;beans:property name="sessionRegistry" ref="sessionRegistry" /&gt; &lt;beans:property name="expiredUrl" value="/login.do" /&gt; &lt;/beans:bean&gt; &lt;beans:bean id="sas" class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy"&gt; &lt;beans:constructor-arg name="sessionRegistry" ref="sessionRegistry" /&gt; &lt;beans:property name="maximumSessions" value="1" /&gt; &lt;/beans:bean&gt; &lt;authentication-manager alias="authenticationManager"&gt; &lt;authentication-provider user-service-ref="jdbcUserService" /&gt; &lt;/authentication-manager&gt; </code></pre>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload