Re: Problems with HttpSessionListener ..

[Mufaddal Khumri]

From my tests so far , i found that the user browser is storing 
cookies. So even when the container is not persisting sessions , the 
client browser tries to use the old session stored in the cookie.  I 
was under the impression that if the user has an old session and tries 
to reach MyWebApp , tomcat would detect an invalid session being used 
and invalidate the old session . How do I deal with this problem ?

On Thursday, September 18, 2003, at 09:16  AM, Mufaddal Khumri wrote:

No, it would not . But if i understand it right .. .the code below in 
server.xml should not persist any sessions.
		
          <Manager 
className="org.apache.catalina.session.PersistentManager"
              debug="0"
              saveOnRestart="false"
              maxActiveSessions="-1"
              minIdleSwap="-1"
              maxIdleSwap="-1"
              maxIdleBackup="-1">
                <Store 
className="org.apache.catalina.session.FileStore"/>
          </Manager>

On Thursday, September 18, 2003, at 09:32  PM, Shapira, Yoav wrote:

Howdy,
Hypothetically speaking, would your listener code works if sessions 
were
persisted by the container prior to the contextDestroyed event? ;)

Yoav Shapira
Millennium ChemInformatics

-----Original Message-----
From: Mufaddal Khumri [mailto:[EMAIL PROTECTED]
Sent: Wednesday, September 17, 2003 11:27 PM
To: Tomcat Users List
Subject: Problems with HttpSessionListener ..
Hi,

I am trying to implement the HttpSessionListener (the same class
implements ServletContextListener). The code for which is below.
1.  I open a browser window , use MyWebApp after logging in it.
2. I open the tomcat manager and reload my MyWebApp. I go to the
console at this point and see the message - "Session is already
invalid." (see code below)
3. I go to my window in step 1. and click on a link to go to a
particular .jsp page. I get a blank window. I check the session
attributes at this point and my session attribute USER_AUTHORIZED
exists and is true.
step 2 s result conflicts with step 3s result. (see code below).
Invalidating the session does not propagate to the client ???????  
What
am i doing wrong ?

        public void contextDestroyed(ServletContextEvent sce)
        {
                // Destroy sessions.
                if(sessions != null)
                {
                        Iterator i = sessions.iterator();
                        while (i.hasNext())
                        {
                                HttpSession s = (HttpSession)i.next();
                    try
                    {
                            if(s != null &&
s.getAttribute("USER_AUTHORISED")
!= null)
                            {
                                System.out.println("Invalidating session
id =
" +
s.getId());
                                s.invalidate();
                            }
                    }
                    catch(IllegalStateException ex)
                    {
                        System.out.println("Session is already
invalid.");
                    }
                        }
                }
                // End Destroy sessions.
        }
        public void sessionCreated(HttpSessionEvent event)
        {
                if(sessions == null)
                        sessions = new HashSet();
                sessions.add(event.getSession());
        }
        public void sessionDestroyed(HttpSessionEvent event)
        {
                if(sessions != null)
                {
                        sessions.remove(event.getSession());
                }
        }


---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




This e-mail, including any attachments, is a confidential business 
communication, and may contain information that is confidential, 
proprietary and/or privileged.  This e-mail is intended only for the 
individual(s) to whom it is addressed, and may not be saved, copied, 
printed, disclosed or used by anyone else.  If you are not the(an) 
intended recipient, please immediately delete this e-mail from your 
computer system and notify the sender.  Thank you.

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]