Servlet session invalidate

Question

Hello All:

I have 2 apps in 2 different servers - Tomcat(basically a .WAR file) and a EAR in jBoss.

EAR is a reusable app where I will authenticate the user and send back the control to the app on the Tomcat. While authenticating I am creating a session object on the jBoss app.

When I send back the control to the app on Tomcat I will ask the user if he wants to sign off the authenticating application. If the user pushes the "Yes" button I will have to logoff that user from the authenticating app

Questions

1) I read that Filter is the best way to invalidate the session. In my case since the authenticating app is intended to be used by more than 1 user how will the filter know which session it needs to invalidate?

2) Should I pass the session id created in the jBoss app to the Tomcat app so that when the user decides to sign off - I will need to pass back the same session id to the jBoss app for the Filter to invalidate?

Answer 1

You don't need a Filter. A simple Servlet will do:

public LogoutServlet extends HttpServlet {
    @Override
    public void doGet(...) {
       request.getSession().invalidate();
    }
}

Then map this servlet to /lougout in web.xml, and whenever the user wants to logout, he should be sent to http://youhost/yourapp/logout.

If you want to log him out when he is already working with the tomcat server, you'd need to redirect back to the JBoss server to invalidate the session there.

Note that request.getSession() gets the current session - i.e. the one that belongs to the user making the request. Your servlet container (server) handles this for you.