Spring session listener

Question

I am new to spring security and use it for authentication. I ran into a problem that when the browser is closed or in case of any unusual failure, the session expires, but I cannot catch the event to execute the cleared code. I sessionDestroyed() this out and found the HttpSessionEventPublisher in spring to capture the HttpSessionDestroyedEvent in sessionDestroyed() , but it doesn't get called when I close the browser.

Request to offer a solution for the same.

Answer 1

Maybe SessionManagementFilter can help?

Or you can configure Spring Security to automatically redirect the user if a timeout occurs: Deny timeouts .

Answer 2

You need to register a listener in web.xml !

  <listener> <listener-class> org.springframework.security.web.session.HttpSessionEventPublisher </listener-class> </listener> 

But, of course, he discovers that the session is closed (due to a timeout or some explicit program destruction session), but he does not detect that someone is closing the browser . This is due to the fact that a notice of closed kliros does not exist.

Answer 3

You can use jQuery to solve the problem of closing the browser,

JQuery will be

 $(window).on('beforeunload', function(){ return 'Are you sure you want to leave?'; }); $(window).on('unload', function(){ //alert("unload"); $.ajax({ type: "POST", url: "Logout.html", //data: "message=" + message, dataType: "html", success: function(response) { }, error: function(e) { //alert('Error: ' + e); } }); }); 

In the spring controller ,

 @RequestMapping(value="Logout.html",method=RequestMethod.POST) public @ResponseBody String logout(HttpSession session){ System.out.println("Request Logout"); // Do you work before invalidate the session session.invalidate(); } 

In web.xml add this. If you used HttpSessionEventPublisher to catch the session kill event,

  <listener> <listener-class> org.springframework.security.web.session.HttpSessionEventPublisher </listener-class> </listener> 

Hope this helps.