Forcing End Of Sessions

          Hi,
          I am attempting to implement Session management functionality that will allow
          Administrators to view and if necessary end a User's or a given set of Users HTTP
          Sessions forcing them to re-logon. I am considering using HttpSession.invalidate()
          to end the sessions. This is fine so long as the user is not in the middle of
          a request but if in the middle of a request I am concerned that it will cause
          some nasty errors.
          Is there a better way of safely ending sessions and if a session is invalidated
          mid request will this end the request?
          Thanks in advance for any info or suggestions.
          Jim

Hi,
 Thanks for that. I originally thought that invalidating the sessions was the neatest
 solution but based on the fact that it will kill any requests in midstream (probably
 not ideal for what I am doing) I think I will just update the User's session to
 indicate that they should re-logon. If the User executes another request they
 will be automatcially re-directed to logoff/re-logon.
 Thanks again for your help.
 Jim
 "KP" <[email protected]> wrote:
 >
 >Hi Jim
 >Your concern about "in the middle of a request" is correct and chances
 >of IllegalStateException
 >generation is high. But if think, you must do it, catch this exception
 >and redirect
 >user to login page.
 >Cheers
 >KP
 >
 >"Jim Donnelly" <[email protected]> wrote:
 >>
 >>Hi,
 >>
 >>I am attempting to implement Session management functionality that will
 >>allow
 >>Administrators to view and if necessary end a User's or a given set
 >of
 >>Users HTTP
 >>Sessions forcing them to re-logon. I am considering using HttpSession.invalidate()
 >>to end the sessions. This is fine so long as the user is not in the
 >middle
 >>of
 >>a request but if in the middle of a request I am concerned that it will
 >>cause
 >>some nasty errors.
 >>
 >>Is there a better way of safely ending sessions and if a session is
 >invalidated
 >>mid request will this end the request?
 >>
 >>Thanks in advance for any info or suggestions.
 >>
 >>Jim
 >

Similar Messages

Force end of session when user closes window without logging out

I want to protect sensitive employee data. Does anyone know how to force a user's portal session to be terminated after a user closes a window with the "X" instead of logging out?

Web application is connectionless. So there is no way to tell if a user has disconnected. If the user diligently logout, then invalidating a session is no problem. However, if you wish to invalidate the user upon closing of window, I suggest you drop that idea and change to different approach.
1. If you are trying to impose single logon policy, you may consider invalidate an existing session if the same user login again.
2. If you really need to invalidate a user session as soon as he is inactive (or closes window). I suggest you set a very small timeout interval (maybe 3 minutes). Then for all the pages, implement a simple invisible IFRAME that will keep refreshing itself (say every 2 minutes) on a dummy JSP/servlet URL. The fact that this IFRAME always hit the URL at 2 mins interval will keep the user session valid. Once the browser window is closed, the session will be invalidated in max 3 mins time.
The final suggestion is to drop that idea altogether, the point is ... implement such feature is like twisting web application to do something that it is not design to do naturally.

Ending a Session

Does anyone know of a way to end a session (AKA force a user to logout) is the same user name is used to logon somewhere else? I have an application where if a username is used to login twice to the same application AKA the user has two open sessions the previously open session needs to be deleted.
When a user logs on it records there sessionid and user id to a table in the database, so I have the session id of the session i want to kill.
Thank you in advance for any help. Let me know if that still sounds to confusing.

Yes, the code I showed in the other post.
sessionKill.cfm
<cfset structClear(session)>

Some file somewhere the detects a user has been logged in twice
<cfhttp url="sessionKill.cfm?cfid=#otherSessionCFID#&cftoken=#otherSessionCFTOKEN#"...>

As I said, this does not actually remove the session from memory of ColdFusion. That can't be done without mucking around with the serviceFactory. But the session will have no data and if a user where to return to it they should not be logged in or have any saved data.

Ending/ Starting Session?

I have this site that when they get to a certain point, I
want their
session to end so they can't go through the whole process
with the same
session.
First, how can I end their session?
Second, how do I force a new session to begin?
Is there something that can be set on the server so that when
people hit
a certain page, a new session is started?

OK - what are you using ASP, .net ?
Session.abandon is pretty simple, it kills all session stuff
(like
variables)
<% Session.Abandon %>
On a page would literally terminate the session
Starting a session is automatic, no action neccesary ?
Gerry
http://www.Mixit.TV
"Lee" <[email protected]> wrote in message
news:eojhgm$l6g$[email protected]..
> I've heard of using
>
> Session.Abandon
>
> Where would this go and how does it work?

Is there a way to force a new session so my "on new session" code will run?

I'm using apex.oracle.com and I find values of application (global) and page items persisting across logins.
I didn't expect that? I thought they would go away when I logged out of APEX. But I can change the values, logout, and log back in to the same values. And when I login and start an application, it's not running my "shared components > application processes" initialization code which is set "on new session".
I thought each login would be a distinct new session with it's distinct set of items. (see definition below)
So when I run an application, is there a way to force a new session so my "on new session" code will run?
>
What Is a Session?
A session is a logical construct that establishes persistence (or stateful behavior) across page views. Each session is assigned a unique identifier. The Application Express engine uses this identifier (or session ID) to store and retrieve an application's working set of data (or session state) before and after each page view.
Because sessions are entirely independent of one another, any number of sessions can exist in the database at the same time. Also, because sessions persist in the database until purged by an administrator, a user can return to an old session and continue running an application long after first launching it. A user can also run multiple instances of an application simultaneously in different browser sessions.
Sessions are logically and physically distinct from Oracle database sessions used to service page requests. A user runs an application in a single Oracle Application Express session from log in to log out with a typical duration measured in minutes or hours. Each page requested during that session results in the Application Express engine creating or reusing an Oracle database session to access database resources. Often these database sessions last just a fraction of a second.
>
Thanks -- Howard

I cleaned up the copy of the Select List code in APEX 4.1.xxx which was not operating correctly before. Now it matches what I have in APEX 4.2.yyyy. And, drum roll please, the select list seemingly works fine there (4.1) as well. But now, the initialization code--which was working fine(!)--FAILS in 4.1!
•
Okay. Maybe this will help. 1) I logged in. Ran the login page but did not login. Opened the "session" window and wrote down the session ID. Logged out and back in. 2) Ran the login page but did not login. Opened the "session" window and .... it has the same session ID? 3) So the session is persisting across logins!! How is that possible?
(More) When I log into 3 different applications, I get a different session ID for each but repeated logins always give the same session ID for any given session.

Forcing end user to open the child form in the resource request dataset

Hi,
Is there any way where we can force end user to open the child form of a resource request dataset and enter the values for the attributes in the child form. The child form attribute is mandatory. However, currently, OIM allows user to submit the request without opening the child form and to enter values for child form attributes(which is mandatory).
Thanks.

Child dataset attributes are set to required="true". But it will come into picture only if end user opens the child form. If he forgets to open the child form, still he is able to submit request without entering values to the attibutes(whose required=true) in the child form. OIM is alowing to submit request if he doesn't open the child form.
I hope i was able to put it in corrrect way.
Thanks.

How to end RDP sessions remotely from different network?

Hi
How to end RDP sessions remotely for windows 2008r2 server from different network?
not from local LAN
Thanks

Hi
what ports need to be open to successfully connect to server behind firewall?
from WAN to LAN using :
net use \\servername_or_IP /USER:username “password“
or
qwinsta /server:ServerIP
Thanks

How to end user session correctly as sys or system user

Hi,
Database version Oracle 10.2.0.3
We have to end user sessions to update database content. We cant stop/shutdown the instance but we have to assure that some users are not logged on.
So we are looking for a solution to end some arbitrary user sessions as sys or system user without using the KILL USER SESSION option. We want to assure that the user sessions end correctly.
Is there a possibility or a command in Oracle 10g to end a user session correctly ?
Thanks for your assistance.

http://download.oracle.com/docs/cd/B19306_01/server.102/b14200/statements_2013.htm#i2053602
I think DISCONNECT SESSION Clause is what you are looking for.
Let us know if this is not the case.

Closing/ending a session in jsp

Hi guys i need help ending my session. I am using session just for parameter passing, my webpages doesnt need login logout function.
These are my basic code:
page1.jsp
<%
String prodlinesel = request.getParameter("prod_line");
session.setAttribute( "sessprodline", prodlinesel );
%>
page2.jsp
<%= session.getAttribute("sessprodline") %>
how,when &where do i end my session ? thanks so much

You can use session.removeAttribute("sessprodline");
Calling session.invalidate() will invalidate the session.
Otherwise it disappears after it times out - normally after about 30 minutes of inactivity from that session.

How to create session and end the session in atg without using ootb

can anyone send the code for creating session(Login) and ending(Logout) session in atg without using ootb.
thankyou!

It is plain simple and is plain old request.getSession(false) and then invalidate the session , but why do you want to do it separately . ATG works behind scenes to associate lot of attributes to the session when log in happens and then deassociates them when log out happens , SessionManager component is also helpful in security , can you state why exactly would you want to do it?

How can i check that who end the session

Hi to all ,
my query is that how can i check that who end the session.
through SM04 user who have the authontication can end the session so how can i check that who end the session being a BASIS admin.
Thanks & Regards

It's wrotes in system log, check in sm21.
Regards.

My Assets iView problem (ESS 50.1.) - "End of Session" returns from ITS

Hi guys!
I have problem with some IAC iViews of ESS 50.1. BP. When I click the link to some of them - My Assets for example, I get screen from its with following message:
End of Session. Thank you for working with Internet Transaction Server.
Other iViews from the BP work fine.
What could be the problem?
Thanx for answers!
Olian

Hi guys!
I have problem with some IAC iViews of ESS 50.1. BP. When I click the link to some of them - My Assets for example, I get screen from its with following message:
End of Session. Thank you for working with Internet Transaction Server.
Other iViews from the BP work fine.
What could be the problem?
Thanx for answers!
Olian

Leave request ITS end of session error

Hi,
There are few users who are a getting a error saying "End Of Session Thank you for working with the Internet Transaction Server! " when they tried to access leave request ( ws20000081) and leave request overview ( ws01000109). this error is coming to particular cost center users, all other users doesn't have this problem. furthermore we have given the auth as well.
For these particular users they have been performing ESS tasks before and this issue came 3weeks back.
i checked the HR org structure nothing has been changed. please help
Regards
Aflal

can you check the same service being launched from r/3 ie
enter /n
and then ws20000081
execute.
This is the case most likely with ITS templates
See the following SDN and HELP.SAP.COM site which will provide more
information.
https://www.sdn.sap.com/irj/scn/wiki?path=/display/home/
InternetTransactionServer&
How to terminate a user session with integrated ITS when the transaction
ends?
and note
959417, "Integrated ITS, Closing Session When Transaction Ends"
Re the "redirection" please review the following:
SAP Note 916727.

End of Session ITS

Hi!
I have problem with transaction iView in ITS, When I click the execute botton, I get "End of Session - Thank you for working with Internet Transaction Server" text. What's wrong? Why is not displayed the transaction? Other transactions incl. Leave Request are O.K. Can it be problem with publishing?
Thanks.

Hi!
I have problem with transaction iView in ITS, When I click the execute botton, I get "End of Session - Thank you for working with Internet Transaction Server" text. What's wrong? Why is not displayed the transaction? Other transactions incl. Leave Request are O.K. Can it be problem with publishing?
Thanks.

Since updating to IOS 6, my autolock is not work if I end the session in Messages, Notes Or Calendar. What's up

since updating to IOS 6, my autolock only works tf I end the session in phone. What's up?

I have the same problem too.

Forcing End Of Sessions

Similar Messages

Maybe you are looking for