Access user session objects from another thread, how to make it?

Question

How can I access a user session objects from another thread?

I want to delete some users on a regular basis. I can just delete them from the database, but some user can be logged in. So I want to invalidate his session if its exists. How can I find and invalidate his session using his userId?

As I understand a servlet container has some hash-like structure to store "sessionId" => "UserSession" mappings. Can I access them? Can I somehow store userIds as keys in that structure?

The alternative which I don't like, is to check the database for user object existence in the beginning of every user request.

Answer 1

You can track your sessions by implementing SessionListener and registering it in your web.xml.

Answer 2

The functionality you were looking for existed but was removed due to security concerns.

You should be able to recreate it by implementing a HttpSessionListener to create your own record of what active sessions exist.