How to invalidate all the sessions

[K Balusu]

Hi,
How can I invalidate the user sessions in webapplications using
JSP/Servlets. Basically this is what we wanted to achieve.

When the system administrator wants to perform certain maintenance
tasks, we want to display a warning message to all the users of the
web application that the server will be offline after 15 mts. Once the
countdown is finished, we would like to close all the sessions that
are active ( we are not planning to shutdown the application, we want
to back/restore the database). Is there any way to do this.
One idea we have is to maintain a application variable ( in the
servlet context) and all the jsp pages check this variable before
loading. But this only works with users that are active and
communicating with the server when the count down is finished. But we
also would like to logoff and close the sessions of all the other
users that might be inactive during this maintenance operation.

TIA,
Regards,
Krishna

 

[John C. Bollinger]

Hi,
How can I invalidate the user sessions in webapplications using
JSP/Servlets. Basically this is what we wanted to achieve.

When the system administrator wants to perform certain maintenance
tasks, we want to display a warning message to all the users of the
web application that the server will be offline after 15 mts. Once the
countdown is finished, we would like to close all the sessions that
are active ( we are not planning to shutdown the application, we want
to back/restore the database). Is there any way to do this.
One idea we have is to maintain a application variable ( in the
servlet context) and all the jsp pages check this variable before
loading. But this only works with users that are active and
communicating with the server when the count down is finished. But we
also would like to logoff and close the sessions of all the other
users that might be inactive during this maintenance operation.

In order to be able to invalidate all the sessions you need to be able
to get your hands on all the sessions. The easiest way I know to do
this is to create an HttpSessionListener class that keeps track of all
the active sessions. This class must be registered as a listener on
your webapp. When you want to invalidate all the sessions you ask your
listener for the Set of sessions (via an API you define), and invalidate
them one by one.

You should also account for the fact that you may not be able to prevent
new sessions from being created while the application is in maintenance
mode, although you surely can prevent successful logins / page views.
That just means you need to make the listener a little smarter and more
aware of application state.


John Bollinger
(e-mail address removed)

 

[Chris Uppal]

But this only works with users that are active and
communicating with the server when the count down is finished. But we
also would like to logoff and close the sessions of all the other
users that might be inactive during this maintenance operation.

If you included an HTTP refresh in every page you generate, set for say 15
minutes, then clients will automatically go back to your server after the
timeout, even if the user has gone off to lunch.

Of course, it will increase the load on your server, but probably not by much.
Also it might irritate people who had entered a load of data into a field, been
called away for a 14 minute phone call, and then seen their page "vanish" just
as they sat back down to get on with what they were doing. But then, hey,
that's life. If they didn't want to be irritated they shouldn't be using a
computer...

-- chris

 

[William Brogden]

Hi,
How can I invalidate the user sessions in webapplications using
JSP/Servlets. Basically this is what we wanted to achieve.

When the system administrator wants to perform certain maintenance
tasks, we want to display a warning message to all the users of the
web application that the server will be offline after 15 mts. Once the
countdown is finished, we would like to close all the sessions that
are active ( we are not planning to shutdown the application, we want
to back/restore the database). Is there any way to do this.
One idea we have is to maintain a application variable ( in the
servlet context) and all the jsp pages check this variable before
loading. But this only works with users that are active and
communicating with the server when the count down is finished. But we
also would like to logoff and close the sessions of all the other
users that might be inactive during this maintenance operation.

Look at the various session listener interfaces for inspiration.
For example HttpSessionListener

Bill