Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #5768

Re: handling stale session

Show all headers | View raw

If you properly cleanup stale sessions (clear the session flag in the
database in your case) on both timeout and logout then this problem is
solved. At login time you simply demand that the session flag in the
database for that IP is cleared.

The only problem that remains is that if someone closes his browser
without logging out properly and then tries to login again shortly after
then he will be refused until his previous session finally times out.
This is a general problem with web applications.
There are several workarounds for this problem. One would be to allow
subsequent logins and simply overwrite the session id in the database
for that IP. In the application you then consciously re-check if the
current session id is equal to the one in the database. If not then the
session has been rendered invalid by a subsequent login and you issue a
message and log the session out.

On 06/29/2011 10:01 AM, a wrote:
> Thanks for your reply.
> I need to check the validity of the session proactively because I only 
> allow one session per IP.
> When there is another login request with a duplicated ip, I have to 
> determine the validity of the existing session.
> 
> 
> "Silvio" <silvio@moc.com> 在郵件 
> news:4e0a4776$0$4352$e4fe514c@news.xs4all.nl 中撰寫...
>> Approach this from the other end. Add a listener to the session to hook
>> into the session timeout and cleanup the session.
>>
>> Silvio
>>
>>
>> On 06/28/2011 12:44 PM, a wrote:
>>> Hi
>>>
>>> My question is about handling the stale session caused by user exit
>>> application without logout. I use a table to maintain session info and
>>> user, e.g, session id, user oid.
>>> If the user exits the application without logout properly or the web
>>> server restart, there is a record left on the table.
>>> I am planning to check the validity of the session id on the table when
>>> the user next login.
>>> Is it possible to check whether the session is still alive or not by
>>> telling the session id?
>>>
>>> Thanks
>>
>>
> 

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar

Thread

handling stale session "a" <a@mail.com> - 2011-06-28 03:44 -0700
  Re: handling stale session Silvio <silvio@moc.com> - 2011-06-28 23:28 +0200
    Re: handling stale session "a" <a@mail.com> - 2011-06-29 01:01 -0700
      Re: handling stale session Silvio <silvio@moc.com> - 2011-06-29 11:31 +0200
        Re: handling stale session "a" <a@mail.com> - 2011-06-29 11:35 -0700
          Re: handling stale session Silvio <silvio@moc.com> - 2011-06-30 00:12 +0200

csiph-web