1

I've developed a system using Spring Security 3.1.4. Most of the configuration is out-of-the-box.

The users of the system are described in a DAO, and on logging in, the request is serviced by my implementation of AuthenticationProvider, which looks them up in the database and returns a UsernamePasswordAuthenticationToken. This happens once at login.

The server APIs are then protected with @PreAuthorize annotations; for example:

@PreAuthorize("hasRole('ROLE_USER') and hasPermission(#order,'createOrder')")
public Response createOrder(Order order)
{
    ...
}

So far, so good; both elements of the above security requirement work fine.

The problem comes from the fact that the admin user can delete other users, removing them from the database. When this occurs, the target user's session ought to be destroyed.

This is attempted as follows:

    List<SessionInformation> sessions = registry.getAllSessions( username, false );
    for ( SessionInformation ses : sessions )
    {
        ses.expireNow();
        registry.removeSessionInformation( ses.getSessionId() );
    }

However, despite this code finding a session and expiring it, the user in question is still able to make further API calls without incident (I've also tried without the removeSessionInformation line)

I see others with this problem, no answers, and I don't know what I can do. Off the top of my head, two options are:

  • Add a filter to catch every request and manually check the session in it, or

  • Reconfigure the system to authenticate every request using the database, or

  • Manually implement my own session management system

but all of these seem stupid and unnecessary, as well as leaving me unsure how to complete them.

This can't be an uncommon problem - please can anyone cast some light on it?

Rob Pridham
  • 4,780
  • 1
  • 26
  • 38
  • I am seeing strange behviour too but not what you described. If I call expireNow() then all subsequent requests will not be accepted any more. Only the requests that were called before expireNow() will respond normally. removeSessionInformation does not seem to have any effect as you described. – che javara Dec 10 '13 at 16:57
  • Try my answer to [this](http://stackoverflow.com/questions/19227285/centralized-system-for-session-management-and-killing-for-spring-security-and/) - I think it involved taking out the 'removeSessionInformation' line, but I'm sure I'd already tried that as above. There is more in that answer, so have a play. I haven't written an answer to my own question for this very reason - uncertainty. – Rob Pridham Dec 10 '13 at 17:10

0 Answers0