Is it possible to invalidate a spring security session?

by

You can’t usually invalidate a user session(s) immediately you change their account information without resorting to a container specific API, since the only way to access the HttpSession is through the HttpServletRequest object.

Instead you can cache the username in an in-memory store and consult it either in a filter or a custom AccessDecisionVoter. Using a flag in the user table isn’t really a great idea, since the flag is transient in nature (it is irrelevant after a server restart) and it’s better to avoid the performance hit of a database query on every request.

There’s a blog article on using custom voters for this kind of thing. It’s out of date but the general approach is sound.

Another approach is to use Spring Security’s SessionRegistry which is part of the session-management functionality. Normally this is used to limit the number of sessions a user can have but can also be used to list currently authenticated users or mark their session for expiry.

It might also be an idea to just reload the user’s privileges, rather than logging them out completely.

More Related Contents:

  1. Spring Boot Security CORS
  2. Handle spring security authentication exceptions with @ExceptionHandler
  3. How do I get the Session Object in Spring?
  4. Spring Boot CORS filter – CORS preflight channel did not succeed
  5. Spring Security exclude url patterns in security annotation configurartion
  6. Spring Security 3.2 CSRF support for multipart requests
  7. Spring Security configuration: HTTP 403 error
  8. No Spring WebApplicationInitializer types detected on classpath
  9. Spring + Web MVC: dispatcher-servlet.xml vs. applicationContext.xml (plus shared security)
  10. getting exception: No bean named ‘springSecurityFilterChain’ is defined
  11. spring autowiring not working from a non-spring managed class
  12. Multiple antMatchers in Spring security
  13. An Authentication object was not found in the SecurityContext – Spring 3.2.2
  14. Spring Security 3.2 CSRF disable for specific URLs
  15. Spring Boot with embedded Tomcat behind Apache proxy
  16. With Spring Security 3.2.0.RELEASE, how can I get the CSRF token in a page that is purely HTML with no tag libs
  17. Looking for a Simple Spring security example [closed]
  18. Understanding contexts in Spring MVC
  19. Spring security 4 custom login j_spring_security_check return http 302
  20. How to avoid the “Circular view path” exception with Spring MVC test
  21. What is difference between @RequestBody and @RequestParam?
  22. Spring Hibernate – Could not obtain transaction-synchronized Session for current thread
  23. How to manually log out a user with spring security?
  24. how to capture multiple parameters using @RequestParam using spring mvc?
  25. How to correctly use PagedResourcesAssembler from Spring Data?
  26. JPA / JTA / @Transactional Spring annotation
  27. Is this very likely to create a memory leak in Tomcat?
  28. What are the differences between Model, ModelMap, and ModelAndView?
  29. How to access plain json body in Spring rest controller?
  30. Set default page size for JPA Pageable Object

Leave a Comment