How to remove existing sessions by specific principal name

Question

I'm using Spring Session 1.3.0 with Redis backend in my project.

I have an use case that the super admin might update the roles of existing user who might already logged in. I want to delete the existing session records for those users after changing their roles.

Is there API of Spring Session to archive it?

score 7 · Answer 1 · answered Feb 07 '17 at 07:17

    @Autowired
    private SessionRegistry sessionRegistry;

    public void expireUserSessions(String username) {
        for (Object principal : sessionRegistry.getAllPrincipals()) {
            if (principal instanceof User) {
                UserDetails userDetails = (UserDetails) principal;
                if (userDetails.getUsername().equals(username)) {
                    for (SessionInformation information : sessionRegistry.getAllSessions(userDetails, true)) {
                        information.expireNow();
                    }
                }
            }
        }
    }

score 6 · Accepted Answer · answered Feb 07 '17 at 13:42

6

Also work out another way to clean sessions of specific user,

@Autowired
FindByIndexNameSessionRepository sessionRepository;

sessionRepository.findByIndexNameAndIndexValue(FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME,
                username).keySet().forEach(session -> sessionRepository.delete((String) session));

answered Feb 07 '17 at 13:42

Kane

8,035
7
46
75

Deleting sessions prematurely has some side effects if you allow multiple sessions of a single user. Have a look on this question. http://stackoverflow.com/questions/22370819/how-to-log-a-user-out-programmatically-using-spring-security – mirmdasif Feb 08 '17 at 07:01
@mirmdasif it's an interesting finding. I'm wondering why spring/spring security still gives the permission of request with invalid session id(expired or removed). – Kane Feb 08 '17 at 07:19

How to remove existing sessions by specific principal name

2 Answers2