Ensuring items are removed when session is destroyed

Question

I have a Spring 2.5 MVC application with the ACEGI security framework on top of that. This application allows the user to upload many files and then "publish" them as a whole. I need to ensure that these files are deleted if the following happens:
1. The user clicks cancel (done, processCancel)
2. The session expires (trying HttpSessionListener)
3. The user navigates away from the page (This can probably fall under session expiration)
4. The user closes the browser(This can probably fall under session expiration)
Currently I implement the HttpSessionListener. I am not getting the same ID on sessionDetroyed that I am getting on sessionCreated. I'm assuming either the session is already destroyed before that event fires. Also, the sessionDestroyed event does not fire when I close the Firefox browser, but it does when I close Internet Explorer.
I was thinking that I can put a static reference to a map of files that need deleted on session expiration in the listener, but I'm still not sure how to link the session ID to the files or the username of the currently logged in user. Basically I need to verify that the files I am deleting do not belong to a user who is still logged in. Is there a better way to do this?

Answer 1

hoffmandirt wrote:
Currently I implement the HttpSessionListener. I am not getting the same ID on sessionDetroyed that I am getting on sessionCreated. I'm assuming either the session is already destroyed before that event fires. The sessionDestroyed event occurs after the session is taken out of commission but before it is invalidated. Every session gets destroyed and will have this sessionDestroyed event called. If you are using sessionEvent.getSession().getID() that will be the ID of the session about to be invalidated. It is hard to say why you are getting different sessions, but my guess is that you get the sessionID early in your app and somewhere you force a new session to be created and you are mixing the two sessions here. Some code may help figure this out. The second session would eventually expire, though, after the session timeout occurs.
Also, the sessionDestroyed event does not fire when I close the Firefox browser, but it does when I close Internet Explorer.Sessions are not destroyed when a browser closes. They are destroyed when you explicitly call a session.invalidate() or when the session times out. If you waited whatever period of time your session is set to timeout after you close the browser, that is when the sessionDestroyed method would be called.
>
I was thinking that I can put a static reference to a map of files that need deleted on session expiration in the listener, but I'm still not sure how to link the session ID to the files or the username of the currently logged in user. Basically I need to verify that the files I am deleting do not belong to a user who is still logged in. Is there a better way to do this?I personally don't like the static resource thing. It gets confusing when you start to worry about class loaders and is too easy to flub. Better would be a map stored in the application context that both your main application has access to and the HttpSessionListener (via the HttpSession object) has access to. But I would also think about wrapping the references to the file in a 'SessionFile' object which would implement HttpSessionBindingListener and would delete itself when the valueUnbound event occurs. So the file would be deleted when the session ends as well as when you simply delete it from the session. No need for an external map in the context/static scope, or an HttpSessionListener running in the background.
public class SessionFile implements HttpBindingListener {
    private final File file;
    private boolean fileInSession = false;
    public SessionFile(File file) { this.file = file; }
    public File getFile() {
        if (!fileInSession) {
            throw new IllegalStateException("Can not access File.  It is no longer stored in session.");
        return this.file; }
    public void valueBound(HttpSessionBindingEvent event) {
        this.fileInSession = true;
        /* any special action when added to the session? */
    public void valueUnbound(HttpSessionBindingEvent event) {
        this.fileInSession = false;
        // delete the file here
}