Question

I have some question about servlet session.I have about create web apps with jsf, with configuration in web.xml:

<session-config>
    <session-timeout>-1</session-timeout>
</session-config>

thats mean session never timeout

I also save the created session id from everyone has logged to database.

my question is how about force destroying all active session with session id
that i have saved in database.

the situation i want to have a admin page,
i can list all active session id
and i can destroy it.

thanks for your help.

Answer 1

You can use an HttpSessionListener and on each sessionCreated(..) to fill a static List with the active sessions.

Then, from the admin interface you can iterate these sessions and call .invalidate() on each.