Issue with Concurrent sessions using Hibernate And Spring 2.5 - spring

Question

I am developing an app with Spring 2.5.6, Spring Security 2.0.4 and Hibernate 3.2.6. In my application a user can login from different browsers with the same credentials concurrently. There is an option to change the email id of the user. Controller which handle this request is as follow :-
#RequestMapping(value="/changeEmail", method= RequestMethod.POST)
public void changeEmail(HttpServletRequest request, HttpServletResponse response, Principal principal) throws IOException
{
System.out.println("We got the Request");
boolean hasError = false;
String currentEmail = request.getParameter("currentEmail");
String newEmail = request.getParameter("newEmail");
String confirmEmail = request.getParameter("confirmEmail");
String password = request.getParameter("password");
System.out.println("Old Email = " + currentEmail + ", New Email = " + newEmail + ", Confirm Email = " + confirmEmail + ", Password = " + password);
Map<String, String> errorsMap = new HashMap<String,String>();
UserFormResponse callBackResponse = new UserFormResponse("",errorsMap);
if(currentEmail == null || currentEmail.equals(""))
{
hasError = true;
errorsMap.put("currentEmail", "Enter Your Current Email");
}
if(newEmail == null || newEmail.equals(""))
{
hasError = true;
errorsMap.put("newEmail", "Enter Your New Email");
}
if(confirmEmail == null || confirmEmail.equals("") || !confirmEmail.equals(newEmail))
{
hasError = true;
errorsMap.put("confirmEmail", "Confirm Your Email");
}
if(password == null || password.equals(""))
{
hasError = true;
errorsMap.put("password", "Enter Your Password");
}
if(!hasError)
{
System.out.print("Should be printed : " + callBackResponse.getStatus());
Authentication auth = SecurityContextHolder.getContext().getAuthentication();
Object myUser = (auth != null) ? auth.getPrincipal() : null;
if (myUser instanceof User) {
User user = (User) myUser;
if(!user.getPassword().equals(password))
{
callBackResponse.setStatus("Wrong Password");
errorsMap.put("password", "Enter Correct Password");
}
else if(!user.getUserEmail().equals(currentEmail))
{
callBackResponse.setStatus("Wrong Email");
errorsMap.put("currentEmail", "Enter Your Current Email");
}
else
{
user.setUserEmail(newEmail);
getHibernateTemplate().update(user);
callBackResponse.setStatus("Success");
}
}
else
{
callBackResponse.setStatus("You must be logged in");
}
}
else
{
callBackResponse.setStatus("Kindly fill all fields");
}
callBackResponse.setErrorsMap(errorsMap);
System.out.println(callBackResponse.getStatus());
System.out.println(callBackResponse.getErrorsMap());
objectMapper.writeValue(response.getOutputStream(),callBackResponse);
}
Email is being changed perfectly when I check the database from the backend. But main issue is if user have two concurrent sessions then email changed in one session is not being reflected in other session untill other session is not being invalidate. Is there any solution so that changes during one session can be reflected to another concurrent session ?
Note : please don't suggest to change the version of spring and hibernate as it is mandatory to develop this application in spring 2.5.6.

Answer 1

First define HttpSessionEventPublisher in web.xml
<listener>
<listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>
Then define <session-management> in your spring security.xml file.
Now, use SessionRegistry in your controller method to invalidate all sessions. Below code retrieves all active sessions.
List<SessionInformation> activeSessions = new ArrayList<SessionInformation>();
for (Object principal : sessionRegistry.getAllPrincipals()) {
for (SessionInformation session : sessionRegistry.getAllSessions(principal, false)) {
activeSessions.add(session);
}
}
On Each active session, you can call expireNow() method to expire or invalidate them.