-
1. Re: Is it necessary for the Seam IdentityImpl.logout() to invalidate the session?
lightguard Jul 19, 2012 2:29 PM (in response to jm01)Probably not, best way to find out though is to try it.
-
2. Re: Is it necessary for the Seam IdentityImpl.logout() to invalidate the session?
jm01 Jul 20, 2012 5:48 AM (in response to lightguard)I wrote the following class (copied from the default implemention, but with the session.invalidate() commented out) which overrides the logout method.
public @Specializes class AltSecurityImpl extends IdentityImpl { @Inject BeanManager beanManager; @Override public void logout() { System.out.println("My Logout Invoked!"); if (isLoggedIn()) { PostLoggedOutEvent loggedOutEvent = new PostLoggedOutEvent(getUser()); beanManager.fireEvent(new PreLoggedOutEvent()); unAuthenticate(); // session.invalidate(); beanManager.fireEvent(loggedOutEvent); } } }
Tested it and it seems to work with jboss-as 7.1.1 (but not with jboss-as 7.0.1 which I also tested upon)
However I don't feel very confident with my way of action. Is there a more elegant way of doing it?
Thank you,
John
-
3. Re: Is it necessary for the Seam IdentityImpl.logout() to invalidate the session?
jm01 Jul 20, 2012 11:38 AM (in response to lightguard)Dear Jason,
The IdentityImpl.logout() implementation did not use to invalidate the session up until SEAMSECURITY-83 (actually it was you who implemented the "fix" ).
From the issue report and the forum reference I fail to understand the reason of why the session has to be invalidated after logout, but I am no expert.
Any advice would be very much appreciated.
Thanks again,
John
-
4. Re: Is it necessary for the Seam IdentityImpl.logout() to invalidate the session?
lightguard Jul 20, 2012 12:06 PM (in response to jm01)John, you may have a different usecase than most people which is just as valid. The common way we saw Security being used was for people to log into their site, perform some work and logout. They were looking for logout to be the same thing as ending their HttpSession. I think you happen to be one of the few (at least that I'm aware of anyway) that liked it the other way ) Using an alternative or specializing should we work for what you want to do.