Question

I want to write a row in a db every time a user logs into my application (that uses spring security), and to add the logout time to that row when he logs out, in order to register the number of access and the duration of the session.

I thought there was some Post-Authentication Filter, but I checked the documentation and couldn’t find any reference of it.

Is too invasive to write a filter and add it to the spring security filter chain?

Is there some another workaround?

Answer 1

Assuming You’re using Spring Security 3.0.x and securing a web application, check out:

• AuthenticationSuccessHandler used by AuthenticationProcessingFilter for actions on successful login.
• And LogoutSuccessHandler used by LogoutFilter for actions on successful logout.