Cult VS. Religion
Friday, December 29th, 2006“The only difference between a cult and a religion is the amount of real estate they own.”
-Frank Zappa
“The only difference between a cult and a religion is the amount of real estate they own.”
-Frank Zappa
The nicest thing about Echo is that is abstracts you from the “page” thing and makes you quickly forgot that you are actually inside a web environment.
Anyway you can’t forget your environment as it influences your design and code decisions.
This is the case of session invalidation and logout actions. I’ve written a small page on the nextapp wiki and I want to propose it here for the search engines’ sake :)
So: how do you log your users out and invalidate their sessions? As always, it depends on what you need to achieve.
The easy and quick way
As you know, Echo2 applications state is synchronized with the model stored into each user’s session. So, if you just want to force the user to start from the beginning, changing the screen will be sufficient
ApplicationInstance.getActive().getDefaultWindow().setContent(new WelcomeMessageScreen());
In no way the user will be able to interact with previously rendered components, so security is safe.
Advantage:
Disadvantage:
The servlet way
If the easy way is not enough because you want to invalidate user’s session as soon as the user logs out, you may implement a short servlet.
public class LogoutServlet extends HttpServlet {
protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
request.getSession().invalidate();
response.sendRedirect(request.getContextPath() + “/”);
}
}
Note: you can’t invalidate the session INSIDE the Echo application, because that will cause a “session expired” message; you need to invalidate the session outside the application. Although it may look weird, it’s actually better as your application SHOULD NOT know in any way that it is running inside an “servlet container” (because Echo abstracts you from that). Having a “Logout Servlet” does not solve the problem, but isolates the session invalidation logic into a known, separate place.
Advantage:
Disadvantage:
The servlet + session listener way
Suppose you also need to log how long a session lasted and/or to dispose other resources and/or to do something else when a user logs in and out.
Then you need to implement the interface !HttpSessionListener and to register it into your servlet container.
An empty one looks like:
public class MySessionListener implements HttpSessionListener {
private static final Log log = LogFactory.getLog(SessionListener.class);public void sessionCreated(HttpSessionEvent arg0) {
log.debug(”new session created”);
}public void sessionDestroyed(HttpSessionEvent arg0) {
log.debug(”a session was destroyed”);
}}
Code the two methods according to your needs. As you may have noticed, the “logout servlet” may be reused quite easily, while the above listener may be more specific to your application.
Advantage:
Disadvantage:
I usually go with the third method, leaving the listener empty until I need it. The cold face of the hammer of gold looks at me, but I don’t care about such a tiny piece of code
Ma le mie tasse non servono anche a pagare la sanità pubblica? Se non si fidano loro che le tasse me le hanno fatte (e me le faranno) pagare, io perchè dovrei fidarmi?
As you may know, I had a talk at JUGMilano about Echo2.
To show the juggers some of the Echo capabilities, I’ve built Echo2Impress, a simple echo application that shows slides, just as OpenOffice Impress does.
Ah! How cool it was to present Echo with Echo! :)
If you want to give Echo a try or if you are just curious about it, take a look at Echo2Impress and its blank presentation project.
Hope you like it ;)