Question

I have been writing a web application that will only create one session per user. This has worked well so far. However, I am running into a problem where if I have a user logout, Spring thinks that user is still logged on. I am invalidating the session with acegi upon logout, but it seems as if Spring does not recognize that:

    <security:logout invalidate-session="true"
                success-handler-ref="logout"
                logout-url="/logout.html" />

So, my question is: does there exist a separate spring session that I must invalidate, and if this is the case, how should I go about doing so?

Thanks in advance.
MirroredFate

Answer 1

If you’re asking if Acegi and SpringMVC use the same session then the answer is yes, they do. You may want to manually invalidate the session in the controller that handles /logout.html.

UPDATE

As the OP mentioned the in the comment below, to invalidate the authentication object use:

SecurityContextHolder.getContext().setAuthentication(null);