How to exclude inactive users? (Spring Security) - spring

Question

I get all active users, but when the user logs out, it is still listed as the active user. How do I prevent a user from being listed as an active user after logging out?
I have not been able to find solutions in the documentation.
https://github.com/romanych2021/TestSession
Thanks.
ActiveUserServiceImpl.java
#Service
public class ActiveUserServiceImpl implements ActiveUserService{
#Autowired
SessionRegistry sessionRegistry;
public List<String > getAllActiveUser(){
List<Object> principals = sessionRegistry.getAllPrincipals();
User[] users = (User[]) principals.toArray(new User[0]);
return Arrays.stream(users)
.filter(user -> !sessionRegistry.getAllSessions(user, false)
.isEmpty()).map(User::getUsername).collect(Collectors.toList());
}
}
SecurityConfig.java
#Configuration
#EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.mvcMatchers("/").permitAll()
.mvcMatchers("/login").anonymous()
.mvcMatchers("/user", "/allUser").hasAnyRole("ADMIN", "USER")
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/login")
.loginProcessingUrl("/login")
.defaultSuccessUrl("/")
.and().csrf().disable()
.logout()
.permitAll()
.logoutUrl("/logout")
.logoutSuccessUrl("/")
.invalidateHttpSession(true)
.deleteCookies("JSESSIONID")
.and().sessionManagement()
.maximumSessions(1)
.expiredUrl("/login")
.sessionRegistry(sessionRegistry);
}
}
HTML
<form method="post" action="/logout">
<button type="submit">Exit</button>
</form>

Answer 1

keep your active users map in a hashMap and remove the loooged out users from that map when day log out.In the value unbound event you can exclude inactive users.
#Getter
#Setter
public class ActiveUserStore {
public HashMap<String, ActorUser> userDetails;
public ActiveUserStore() {
userDetails = new HashMap<>();
}
}
#Getter
#Setter
public class LoggedUser implements HttpSessionBindingListener {
private ActorUser sessionUser;
private ActiveUserStore activeUserStore;
public LoggedUser(ActorUser sessionUser, ActiveUserStore activeUserStore) {
this.activeUserStore = activeUserStore;
this.sessionUser = sessionUser;
}
#Override
public void valueBound(HttpSessionBindingEvent event) {
HashMap<String, ActorUser> userDetails = activeUserStore.getUserDetails();
LoggedUser loggedUser = (LoggedUser) event.getValue();
if (isNotNull(userDetails) && !userDetails.containsKey(loggedUser.getSessionUser().getUsername())) {
userDetails.put(loggedUser.getSessionUser().getUsername(), loggedUser.getSessionUser());
}
}
#Override
public void valueUnbound(HttpSessionBindingEvent event) {
LoggedUser loggedUser = (LoggedUser) event.getValue();
HashMap<String, ActorUser> userDetails = activeUserStore.getUserDetails();
if (isNotNull(userDetails) && isNotNull(loggedUser.getSessionUser()) &&
userDetails.containsKey(loggedUser.getSessionUser().getUsername())) {
userDetails.remove(loggedUser.getSessionUser().getUsername());
}
}

Answer 2

In order to solve this problem, I needed to create only one class.
package com.testsession.service;
import org.springframework.security.web.session.HttpSessionEventPublisher;
import org.springframework.web.WebApplicationInitializer;
import javax.servlet.ServletContext;
public class MyWebAppInitializer implements WebApplicationInitializer {
#Override
public void onStartup(ServletContext container) {
container.addListener(new HttpSessionEventPublisher());
}
}