How would we sync HttpSession with SessionRegistry in Spring - spring

Question

How would we sync HttpSession with SessionRegistry in Spring
I have the following code which works fine
#Bean
public SessionRegistry sessionRegistry() {
return new SessionRegistryImpl();
}
#Bean
public ConcurrentSessionFilter concurrentSessionFilter() {
return new ConcurrentSessionFilter(sessionRegistry(), new SimpleRedirectSessionInformationExpiredStrategy("/"));
}
#Bean
public ServletListenerRegistrationBean<HttpSessionEventPublisher> httpSessionEventPublisher() {
return new ServletListenerRegistrationBean<HttpSessionEventPublisher>(new HttpSessionEventPublisher());
}
//Autowired Session Registry
List<String> users = sessionRegistry.getAllPrincipals().stream()
.filter(u -> !sessionRegistry.getAllSessions(u, false).isEmpty())
.map(Object::toString)
.collect(Collectors.toList());
boolean expieredAtLeastOneSession = false;
users.forEach(System.out::println);
System.out.println(sessionRegistry.getAllPrincipals());
for (final Object user : sessionRegistry.getAllPrincipals()) {
User actualUser = (User) user;
System.out.println("Testing 1");
List<SessionInformation> sessions = sessionRegistry.getAllSessions(user, true);
for(SessionInformation session : sessions) {
System.out.println("Testing 2");
session.expireNow();
sessionRegistry.removeSessionInformation(session.getSessionId());
publisher.publishEvent(AskToExpireSessionEvent.of(session.getSessionId()));
expieredAtLeastOneSession = true;
}
}
My scenario is , User A logs in and user B logs in, A calls this method to invalidate/expire B's session Registry. Uptil here it works fine. However when B refreshes the page he/she is still logged in! This is my question, how can I prevent B from seeing the restricted page or I may also put it, how can the HttpSession be in sync with SessionRegistry?

Answer 1

These settings worked
#Bean
public SessionRegistry sessionRegistry() {
return new SessionRegistryImpl();
}
#Bean
public ConcurrentSessionFilter concurrentSessionFilter() {
return new ConcurrentSessionFilter(sessionRegistry(), new SimpleRedirectSessionInformationExpiredStrategy("/"));
}
#Bean
public ServletListenerRegistrationBean<HttpSessionEventPublisher> httpSessionEventPublisher() {
return new ServletListenerRegistrationBean<HttpSessionEventPublisher>(new HttpSessionEventPublisher());
}
#Bean
public ConcurrentSessionControlAuthenticationStrategy concurrentSessionControlAuthenticationStrategy() {
ConcurrentSessionControlAuthenticationStrategy concurrentSessionControlAuthenticationStrategy =
new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry());
concurrentSessionControlAuthenticationStrategy.setExceptionIfMaximumExceeded(true);
concurrentSessionControlAuthenticationStrategy.setMaximumSessions(1);
return concurrentSessionControlAuthenticationStrategy;
}
#Bean
public SessionFixationProtectionStrategy sessionFixationProtectionStrategy() {
return new SessionFixationProtectionStrategy();
}
#Bean
public RegisterSessionAuthenticationStrategy registerSessionAuthenticationStrategy() {
return new RegisterSessionAuthenticationStrategy(sessionRegistry());
}
#Bean
public CompositeSessionAuthenticationStrategy compositeSessionAuthenticationStrategy() {
List<SessionAuthenticationStrategy> sessionAuthenticationStrategyList = new ArrayList<>();
sessionAuthenticationStrategyList.add(concurrentSessionControlAuthenticationStrategy());
sessionAuthenticationStrategyList.add(sessionFixationProtectionStrategy());
sessionAuthenticationStrategyList.add(registerSessionAuthenticationStrategy());
return new CompositeSessionAuthenticationStrategy(sessionAuthenticationStrategyList);
}
and
http....and().sessionManagement()
.maximumSessions(1).sessionRegistry(sessionRegistry()).expiredUrl("/logout")
.and().sessionAuthenticationStrategy(compositeSessionAuthenticationStrategy());
Now It is logging out users on refresh. I think I should setup an (periodic) Ajax call to the server to see if the user is logged in and redirect if not.