Question

We need a functionality of killing a specific session (by session ID) from some kind of an admin panel.

I attempted using the following approach:

public static void killSession(String sid) {

    HttpSessionContext sc = FacesUtil.getSession().getSessionContext();
    HttpSession session=sc.getSession(sid);        

    session.invalidate();
}

However

1. HttpSessionContext, and getSessionContext() and
   getSession(sessionId) methods of a session are all deprecated (for seemingly paranoid security reasons)
2. The above code also gets a null session when invoked in an ApplicationScoped JSF managed bean

I’m seeking an alternative way of achieving the functionality.

Answer 1

Yes, you can’t invalidate session from another session due to security reasons. What you can do is to manually store all sessions in some static attribute available to admin. So user logs in, you add him and his session to this attribute (usually a Map/HashMap with user as a key and session as value).

Look at my older answer here and you will get an idea.