How to create a new session in spring?

Question

i am using spring 3 (annotations) with jsf, and i know how to create a session and how to invalidate it afterwards...

so when i login and use the logout button at the end, then everthing works great. but the problem is, the session remains if i don't click at the logout button. if i now log in with a different user, then the old session data remains - cause the old session wasn't invalidated.

so how can i force the system to create a new session if the old session wasn't invalidated?

Answer 1

You should clear the session when the user logs in. This way, whether they've logged out or not, you're starting fresh:

@RequestMapping("login")
public String login(LoginForm form, HttpServletRequest request, HttpSession session) {

    session.invalidate();
    HttpSession newSession = request.getSession(); // create session

    // log the user in

    return "successPage";
}