Seam 3 - Invalidate session on logout

[bschoen]

I just noticed that the session is not being invalidated on logout for seam 3. A google search seemed to indicate that for Seam 2 it was being done and when I look at the code for Seam 3 I find:

// TODO - invalidate the session
// Session.instance().invalidate();

in IndentityImpl.java.

I guess I'll code the call to logout and then invalidate the session myself. Is there a reason this didn't get implemented?

[lightguard]

Please create a JIRA ticket

[bschoen]

SEAMSECURITY-83

[smurfs.smurfsturf.googlemail.com]

You've probably figured it out, but for the benefit of others one solution is to define a method which observes the PostLoggedOutEvent fired by IdentityImpl.logout(). This is an approach I've used.

@RequestScoped
public class EventHandler {

    private static final Logger logger = Logger.getLogger(EventHandler.class);
    @Inject
    private HttpServletRequest httpRequest;

    public void handlePostLoggedOutEvent(@Observes final PostLoggedOutEvent event) {
        logger.logv(Level.DEBUG, "PostLoggedOutEvent triggered by user: {0}", event.getUser().getId());
        httpRequest.getSession().invalidate();
    }
}

The injection of HttpServletRequest does create a dependency on the Seam 3 Servlet module though.

[kwutzke]

What would probably be the easiest solutions without the dependency to Seam 3 Servlet?

Thanks
Karsten

[lightguard]

If you're using JSF you can get the session from the FacesContext via the external context

[kwutzke]

Works perfectly, thanks.

I still wonder how to get the @Inject solution to work. I get a warning in Eclipse saying No bean is eligible for injection to the injection point §5.2.1 (and later the expected Weld exception)...

Karsten

[lightguard]

The injection solution works fine if you include Seam Servlet (pre 3.1.0.Beta3) because there are producers for all of the Servlet API classes like HttpSession, the request, etc.

[kwutzke]

Oh that's why the Servlet module got moved. Thanks for the info. I appreciate it.

Karsten