如何以编程方式使用户超时会话过期

Question

我希望用户注销，即使他们有活动会话，如果管理员禁用或删除了他们。我使用过滤器进行操作，但我无法清除会话，我甚至不明白为什么？

我还在web.xml文件中添加了HttpSessionEventPublisher

public class CheckUserFilter extends GenericFilterBean{
private AuthenticationTrustResolver authenticationTrustResolver = new AuthenticationTrustResolverImpl();
@Autowired
private UserService userService;
@Autowired
private SessionRegistryImpl sessionRegistryImpl;
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException{
boolean enabled = true;
HttpServletRequest req = (HttpServletRequest) request;
String ajaxHeader = ((HttpServletRequest) request).getHeader("X-Requested-With");
if ("XMLHttpRequest".equals(ajaxHeader)) {
if (!authenticationTrustResolver.isAnonymous(SecurityContextHolder.getContext().getAuthentication())) {
UserDetails loggedUser = (UserDetails) SecurityContextHolder.getContext()
.getAuthentication().getPrincipal();

enabled = userService.isUserEnabled(loggedUser.getUsername(), req);
if(!enabled){
//req.logout();
List<SessionInformation> sessions = sessionRegistryImpl.getAllSessions(SecurityContextHolder.getContext()
.getAuthentication().getPrincipal(), false);
sessionRegistryImpl.getSessionInformation(sessions.get(0).getSessionId()).expireNow();
request.getRequestDispatcher("/login").forward(request, response);

}
}
}
chain.doFilter(request, response);
}
}

Answer 1

HttpSession对象有invalidate方法使其自身过期。

https://tomcat.apache.org/tomcat-5.5-doc/servletapi/javax/servlet/http/HttpSession.html#invalidate((