在春季销毁另一个用户的会话

本文介绍了在春季销毁另一个用户的会话的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！ 问题描述

在我的应用程序中，我有一个可以删除用户的管理员.因此，当我从管理会话中删除用户时，我希望删除的用户应自动注销. 我知道我要删除的用户的会话ID，但是我不知道如何使用该会话ID来使会话无效.

In my application, I have an admin that can delete users. so when I delete a user from the admin session I want that the deleted user should get logged out automatically. I know the user's session id whom I delete but I don't know how to invalidate a session using the session id.

我想要类似的东西:invalidate(SessionId);

I would like something like: invalidate(SessionId);

有可能吗?我认为有可能使用过滤器并根据请求检查数据库，但是还有另一种方式我不需要在每个httprequest上检查数据库吗?

Is it possible in any way? I think it is possible using a filter and checking the database every on request but is there another way where I don't need check the db on every httprequest?

谢谢. :D

推荐答案

我认为我看到了使用Spring Security基础结构和 SessionRegistry 类.

I think I see a solution using the Spring Security infrastructure, with the SessionRegistry class.

您必须在web.xml中注册HttpSessionEventPublisher:

<listener> <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class> </listener>

在您的Spring配置中，声明SessionRegistry.

In your Spring config, declare the SessionRegistry.

<bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" />

在管理控制台中，您必须使用SessionRegistry来检索用户的SessionInformation并调用expireNow.根据用户的下一个请求，servlet过滤器应使HttpSession过期. SessionInformation 对其工作方式进行了一些解释.

In your administration console, you have to use the SessionRegistry to retrieve the SessionInformation of the user and call expireNow. At the next request of the user, a servlet filter should make the HttpSession expire. The javadoc of SessionInformation has some explanation about how it works.

让我们知道是否有帮助.

Let us know if that helps.