java - How do I get a list of all HttpSession objects in a web application? -
let's have running java-based web application 0 or more valid httpsession
objects associated it. want way access current list of valid httpsession
objects. thinking implement httpsessionlistener
, use append list of session id values stored in application-scoped attribute, i'm on hook update list sessions invalidated , knows else.
before start baking own solution thought should ask question:
does servlet api provide means of getting access complete list of non-invalidated session objects?
i using tomcat 6.x web application container, , myfaces 1.2.x (jsf) library.
solution
followed approach similar balusc discussed in these existing questions:
- how implement "who online" in grails or java application ?
- jsf: how invalidate user session when logs twice same credentials
i modified sessiondata
class implement httpsessionbindinglistener
. when binding event happens, object either add or remove set of sessiondata
objects.
@override public void valuebound(httpsessionbindingevent event) { // custom application-scoped attribute applicationdata applicationdata = getapplicationdata(); // set of sessiondata objects , add myself set<sessiondata> activesessions = applicationdata.getactivesessions(); if (!activesessions.contains(this)) { activesessions.add(this); } } @override public void valueunbound(httpsessionbindingevent event) { httpsession session = event.getsession(); applicationdata applicationdata = getapplicationdata(); set<sessiondata> activesessions = applicationdata.getactivesessions(); if (activesessions.contains(this)) { activesessions.remove(this); } }
the 1 thing continues irritate me happens when tomcat restarted. unless tomcat has been configured not serialize sessions disk, so. when tomcat starts again, httpsession
objects (and sessiondata
objects along them) deserialized , sessions made valid again. however, serialization/deserialization totally sidesteps httpsession
listener events, not have opportunity gracefully put deserialized reference sessiondata
in managed set of objects after restart.
i don't have control on production configuration of tomcat in customer's organization, cannot assume done way expect it.
my workaround compare httpsession
creation time application startup time when request received. if session created before application startup time, call invalidate()
, user sent error/warning page explanation of happened.
i application startup time implementing servletcontextlistener
, storing current time inside application-scoped object within contextinitialized()
method of listener.
no, servlet api doesn't provide way. have hold of them of httpsessionlistener
. can find several examples in following answers:
Comments
Post a Comment