Echo2: how to log users out and close their session
Tuesday, December 26th, 2006The nicest thing about Echo is that is abstracts you from the “page” thing and makes you quickly forgot that you are actually inside a web environment.
Anyway you can’t forget your environment as it influences your design and code decisions.
This is the case of session invalidation and logout actions. I’ve written a small page on the nextapp wiki and I want to propose it here for the search engines’ sake :)
So: how do you log your users out and invalidate their sessions? As always, it depends on what you need to achieve.
The easy and quick way
As you know, Echo2 applications state is synchronized with the model stored into each user’s session. So, if you just want to force the user to start from the beginning, changing the screen will be sufficient
ApplicationInstance.getActive().getDefaultWindow().setContent(new WelcomeMessageScreen());
In no way the user will be able to interact with previously rendered components, so security is safe.
Advantage:
- quick: you could already have a “welcome” screen, so “closing” your application is just the line above
Disadvantage:
- the session is still open
The servlet way
If the easy way is not enough because you want to invalidate user’s session as soon as the user logs out, you may implement a short servlet.
public class LogoutServlet extends HttpServlet {
protected void service(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
request.getSession().invalidate();
response.sendRedirect(request.getContextPath() + “/”);
}
}
Note: you can’t invalidate the session INSIDE the Echo application, because that will cause a “session expired” message; you need to invalidate the session outside the application. Although it may look weird, it’s actually better as your application SHOULD NOT know in any way that it is running inside an “servlet container” (because Echo abstracts you from that). Having a “Logout Servlet” does not solve the problem, but isolates the session invalidation logic into a known, separate place.
Advantage:
- more control: session is invalidated programmatically.
Disadvantage:
- the above code may look reusable, but what if you need to dispose other resources as well? Read on
The servlet + session listener way
Suppose you also need to log how long a session lasted and/or to dispose other resources and/or to do something else when a user logs in and out.
Then you need to implement the interface !HttpSessionListener and to register it into your servlet container.
An empty one looks like:
public class MySessionListener implements HttpSessionListener {
private static final Log log = LogFactory.getLog(SessionListener.class);public void sessionCreated(HttpSessionEvent arg0) {
log.debug(”new session created”);
}public void sessionDestroyed(HttpSessionEvent arg0) {
log.debug(”a session was destroyed”);
}}
Code the two methods according to your needs. As you may have noticed, the “logout servlet” may be reused quite easily, while the above listener may be more specific to your application.
Advantage:
- total control: forget for a while the beauty of Echo abstracting you from the web thing and brush up your servlet knowledge
Disadvantage:
- more code to write and maintain
I usually go with the third method, leaving the listener empty until I need it. The cold face of the hammer of gold looks at me, but I don’t care about such a tiny piece of code