Menu
I am using Spring Security 3.1 and am using
<concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
Is there a way to force the session to close when the browser closes? I need to keep the max-sessions to 1 for concurrency control.
Thanks!
639
I would add a custom filter of my own just before the "CONCURRENT_SESSION_FILTER" and check in the request URI for a string like "force-logout.do" (or something similar).
Then, in the HTML generated I would have a JavaScript event handler like the following:
<script type="text/javascript">
function force_logout() {
// AJAX request to server notifying that the browser has been closed.
}
</script>
<body onbeforeunload="force_logout();">
</body>
That would work for IE and Firefox (you should check other browsers as well). Your filter just needs to check the URI and perform a session.invalidate() in case it matches the "force logout URI" and return immediately or just bypass the request to the filter chain otherwise.
NOTE: I'm not adding the AJAX code since I don't know if you are using a specific AJAX framework. With prototype.js it would be fairly simple.
68
I had similar issue, like
The code I have on my spring security file is:
<session-management invalid-session-url="/?timeout=true">
<concurrency-control max-sessions="1" expired-url="/logout?timeout" />
I solved this issue by adding the session timeout entry in web.xml file. I put the session timeout value as 5 min, build the application and deployed. Its working fine.
Might be this will help someone.
Thanks, Atul
44
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
