How can I Invalidate a http session by using session id

Question

I am logged in with a different user account, but I have hashmap with the created http session id's in it and I need to invalidate an http session by using sessionid.

Is there any way to do that?

Answer 1

There is no standard way to remove a session only knowing the session id.

Maybe you can trick the server by sending the fake session id (as cookie or http-parameter) to take over one other's session and try to invalidate it with some of the application's methods (e.g. "logout").

But there is not a JSP or something within tomcat, which can do this.

If you want to invalidate sessions in an application you deploy on that server, you might be interested in How can i load Java HttpSession from JSESSIONID?

Answer 2

There is a couple of solutions to this. Solution 1: Described here How can i load Java HttpSession from JSESSIONID? Issue here is we need to store all the sessions created in Map. There is a security risk here.

Solution 2: Implement a logout API something like this.

    @RequestMapping(value = "/logout", method = RequestMethod.GET)
public ResponseEntity<Resource> logout(HttpServletRequest request, HttpServletResponse response) {
    HttpSession session = request.getSession(false);
    LOG.info("Clean session: sessionId: [{}]", session == null ? "null" : session.getId());
    if (session != null) {
        session.invalidate();
    }

    return new ResponseEntity<>(new Resource<String>(), HttpStatus.OK);
}

When invoking this API, add the following cookie in the header , say your session is 49A77C2ED71E3240FC2CC5DBD20C7CCE then request would be something like this

curl --location --request PUT 'https://your.server.com/<somepath>/logout' \ --header 'Authorization: Some authToken if required' \ --header 'cookie: JSESSIONID=49A77C2ED71E3240FC2CC5DBD20C7CCE; Path=/<somepath>; Secure; HttpOnly'

Answer 3

You can use under given method

session.invalidate();

OR you can remove all attributes from session and invalidate

Enumeration<String> attributes = request.getSession().getAttributeNames();
while (attributes.hasMoreElements()) {
    String attribute = attributes.nextElement();
    session.removeAttribute(attribute);
}

session.invalidate();