在春季销毁另一个用户的会话 [英] Destroy a session of another user in spring
问题描述
在我的应用程序中,我有一个可以删除用户的管理员.因此,当我从管理会话中删除用户时,我希望删除的用户应自动注销. 我知道我要删除的用户的会话ID,但是我不知道如何使用该会话ID来使会话无效.
In my application, I have an admin that can delete users. so when I delete a user from the admin session I want that the deleted user should get logged out automatically. I know the user's session id whom I delete but I don't know how to invalidate a session using the session id.
我想要类似的东西:invalidate(SessionId);
I would like something like: invalidate(SessionId);
有可能吗?我认为有可能使用过滤器并根据请求检查数据库,但是还有另一种方式我不需要在每个httprequest上检查数据库吗?
Is it possible in any way? I think it is possible using a filter and checking the database every on request but is there another way where I don't need check the db on every httprequest?
谢谢. :D
推荐答案
I think I see a solution using the Spring Security infrastructure, with the SessionRegistry class.
您必须在web.xml
中注册HttpSessionEventPublisher
:
<listener>
<listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>
在您的Spring配置中,声明SessionRegistry.
In your Spring config, declare the SessionRegistry.
<bean id="sessionRegistry"
class="org.springframework.security.core.session.SessionRegistryImpl" />
在管理控制台中,您必须使用SessionRegistry
来检索用户的SessionInformation
并调用expireNow
.根据用户的下一个请求,servlet过滤器应使HttpSession过期.
In your administration console, you have to use the SessionRegistry
to retrieve the SessionInformation
of the user and call expireNow
. At the next request of the user, a servlet filter should make the HttpSession expire. The javadoc of SessionInformation has some explanation about how it works.
让我们知道是否有帮助.
Let us know if that helps.
这篇关于在春季销毁另一个用户的会话的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!