Invalidating a session

I have the following situation in a web application that requires log in: User loges in. Browses around and loges out (where session.invalidate() is called). If he goes back (press the back button on the browser) to the page after the login and reloads, user data (username and password) is posted again and the user is logged in again. How do I prevent this from happening? If a user loges out I don't want the username and password to be posted again without entering them.

Okay.. I've done some research. This seems to be a common problem with no good solution. I've found two suggestions. Firstly, there's the "disable the back button solution" which isn't an option for me but here is the link in case you want to implement:
http://www10.brinkster.com/A1ien51/Scripts/BackButton.htm
The second is basically what I said in my previous post. I have tested this with a dummy page and it works well to distinguish between a legitimite submit and a pressing the back button (or copying and pasting the URL). Please find below the code listing. If you have any questions please don't hesitate to ask.
~Rob Lundeen
-->TestBackButtonBug.jsp
<%@ page language="java" errorPage="errorpage.jsp" contentType="text/html;charset=windows-1252" %>
<%@ taglib uri="/webapp/DataTags.tld" prefix="jbo" %>
<%@ page import="oracle.jbo.ApplicationModule, oracle.jbo.JboException" %>
<%@ page import="oracle.jbo.html.*" %>
<% RequestParameters params = HtmlServices.getRequestParameters(pageContext);
String formTimeStamp = "";
String serverTimeStamp = ""; %>
<html>
<head>
<META NAME="GENERATOR" CONTENT="Oracle JDeveloper">
<LINK REL=STYLESHEET TYPE="text/css" HREF="bc4j.css">
<TITLE>TESTING</TITLE>
</head>
<body>
<h3>Testing Back Button Bug</h3>
<% // Grab the current time and get a string which will change every millisecond
java.util.Date now = new java.util.Date();
String timeStamp = Long.toString(now.getTime());
// check to see if this is a postback or not
if (request.getMethod().equalsIgnoreCase("POST")) {
// parse out the timeStamp querystring parameter
formTimeStamp = params.getParameter("timeStamp");
// grab the session attribute we have set (at the end of the page)
serverTimeStamp = (String)session.getAttribute("SystemChangeDiagram.LoginPage");
// compare the two. If they match, then this is a "clean" post, if not it is
// the result of the back button or a URL paste
if (formTimeStamp.equalsIgnoreCase(serverTimeStamp)) {
%>Clean Post and txtInput=<%=params.getParameter("txtInput")%><%
} else {
// dump some output to show why this failed
%>Dirty Post (Back button, submit twice or url paste) and txtInput=<%=params.getParameter("txtInput")%>
--formTimeStamp=(<%=formTimeStamp%>)
serverTimeStamp=(<%=serverTimeStamp%>)<%
%>
<%-- Make the form that will submit the text field and hidden field --%>
<form name="Test" action="TestBackButtonBug.jsp" method="POST">
<table border="0">
<tr>
<td title="Test" align="right">
Input Data
</td>
<td title="">
<input type="text" name="txtInput">
</td>
</tr>
</table>
<%-- here's the hidden field "timeStamp" which holds the value --%>
<input type="hidden" name="timeStamp" value="<%=timeStamp%>">
<input type="submit" value="Update">
<input type="reset" value="Reset">
</form>
<% // Set the session attribute. This will change after we have recieved the first
// post but the cached page (in the browsers history) will have the old timestamp
// so it will not match up
session.setAttribute("SystemChangeDiagram.LoginPage", timeStamp);
%>
</body>
</html>

Similar Messages

How can we cleanup invalidated archive sessions (remove from UNIX)

Over the years, we have accumulated many invalidated archive session files in our archive directory in UNIX. We would love to remove these invalidated session files to free up space.
We have been looking at BC_ARCHIVE ... but the documentation on it only mentions the archive of logs ... not the cleanup of invalid session files that need to be deleted
Can we just delete the files of sessions that are invalid? Or must we perform some function in SAP to delete them? SAP ... can you document the process for this?

Hi,
You can simply delete the archive files at unix level thats all. No need to do anything else in SAP.
Cheers!
Samanjay

How to find the invalid form session in oracle Apps

Oracle Apps R12
Hai All
How to find the invalid form session in oracle Apps R12 and How to Kill the that.
Thanks & Regards
Srikkanth.M

Hi,
Please refer to these docs (for 11i and R12).
How to Kill Inactive Sessions Based on the Information in the Monitor User Form [ID 103516.1]
Script: How To Identify The apps User Using The O/S PID For Forms Users In 11i [ID 185762.1]
Thanks,
Hussein

Authentication Fault: Invalid User Session Token

Hi,
I am trying to protect a call to third party webservices using OWSM and OAM. I followed the steps mentioned in Oracle Web Services Manager
Deployment Guide to integrate OAM in OWSM, but not able to make any break through. I am getting following error if I test my web service using OWSM's inbuilt test tool:
<SOAP-ENV:Envelope
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Body>
<SOAP-ENV:Fault>
<faultcode
xmlns:p="http://schemas.oblix.com/ws/2003/08/Faults">p:Client.AuthorizationFault</faultcode>
<faultstring>Authentication Fault: Invalid User Session Token</faultstring>
null</SOAP-ENV:Fault>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
In gateway.log file, I get following oneliner message:
security.SimpleXMLCredsExtractor - SimpleXMLCredsExtractor failed to Extract creds.
I am using standalone OWSM installation.
Installed OAM SDK on the same machine of OWSM.
Added OAM SDK libraries into OWSM's path.
Please advise as I have already wasted 3-4 weeks into it.
.. Paresh
Edited by: user10301925 on Sep 29, 2009 2:24 AM
Edited by: user10301925 on Sep 29, 2009 2:24 AM

Hi,
Yes, I have registered the service in OWSM and calling that service through OWSM testing tool only...
Following is the request message:
<?xml version="1.0" encoding="UTF-8" ?>
- <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
- <soap:Header>
- <wsse:Security env:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">
- <wsse:UsernameToken xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:Username>owsmuser</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">welcome11</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</soap:Header>
- <soap:Body xmlns:ns1="http://service/">
<ns1:getDateTime />
</soap:Body>
</soap:Envelope>
Please advise.
.. Paresh

ECC-- SAP PI-- Successfactor Integration: Invalid SFAPI session

Hello Experts,
   I am working on EmployeeData Synchronization interface the content of which is predelivered from SAP.
I configured the interface and while testing
as first step I was able to retrieve the session ID from Successfactor,
but using the session ID retrieved from Successfactor cloud application when I am trying to upsert data in the second step I am getting an error "Invalid SFAPI session".
How can I overcome this error?
I have done my research on the SDN and went through the blogs but for not much use.
I am sure about the content and the version being used by me as the correct one.
Has anybody seen this error and if yes how did you overcome the same?
Please let me know.
One point that I have to make is that since I was able to retrieve the session ID I did not install the certificates from Successfactors.
Is installing the certificates mandatory and if yes which step is this being referred?
Any help is really appreciated.
Anu Patyath

First of all, you should get it running with SOAP UI:
Please make sure, you got those steps right behind each other:
login
upsert
logout
The important step is to set "Main HTTP session":
You can use the payloads for login, upsert and logout as they are generated by SOAP UI when importing the WSDL.
e.g. upsert:
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:urn="urn:sfobject.sfapi.successfactors.com">
   <soap:Header/>
   <soap:Body>
      <urn:upsert>
       <urn:type>User</urn:type>
       
       <urn:sfobject>
       <urn:upsert>
       <urn:type>User</urn:type>
       
       <urn:sfobject>
            <urn:type>User</urn:type>
            <urn:type>User</urn:type>
            <urn:status>active</urn:status>
            <urn:externalId>testuser</urn:externalId>
            <urn:username>testuser</urn:username>
       </urn:sfobject>
     <urn:processingParam>
          <urn:name>sendWelcomeMail</urn:name>
          <urn:value>true</urn:value>
     </urn:processingParam>
     </urn:upsert>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>

Invalid Kiosk session configuration...

Guys,
I have a Solaris-based SRSS 4.2 installation. I have Global Kiosk set to connect to VMware View server (and it works fine).
I have certain people that need to connect to their Linux desktops. So I created another Kiosk configuration using the Kiosk Mode Generic Session (http://wiki.sun-rays.org/index.php/SRSS_Addon:_Kiosk_Mode_Generic_Session)
My generic.conf looks like this:
KIOSK_SESSION_EXEC=$KIOSK_SESSION_DIR/generic-session
KIOSK_SESSION_LABEL="SGD"
KIOSK_SESSION_DESCRIPTION="Provides an SGD X session for running a Kiosk script."
KIOSK_SESSION_ARGS="/usr/bin/firefox http://sgdserver/sgd"
KIOSK_SESSION_PROTOTYPE=generic-session
I have then ran these commands to import the configuration and assign it to certain users:
# utkiosk -i SGD -f generic.conf
# utkiosk l
SGD
session
Now assign the SGD configuration to users token:
# utkioskoverride -r Payflex.xxxxxxx -s kiosk -c SGD
Heres the kick If I set Global Kiosk to SGD, it works fine and brings up SGD login page as it is supposed to.
If I set Global Kiosk back to View and try to use a smartcard to bring up SGD for the particular user, I get:
Login Incorrect, please try again
then an error stating:
Error starting Kiosk session: Invalid Kiosk session configuration
In the logs I see this:
kiosk:initsession[14382]: [ID 702911 user.error] Error: $KIOSK_SESSION not specified
Jan 12 15:30:55 dsys-vfrb-sray1 kiosk:initsession[14383]: [ID 702911 user.error] Error: failed to load Session Descriptor
Jan 12 15:30:55 dsys-vfrb-sray1 dtlogin[14250]: [ID 705508 user.error] pam_kiosk: pam_sm_open_session: Child process /opt/SUNWkio/lib/initsession failed with exit code 1.
Any ideas? It works fine in my Lab, but at a customer site, it does not work!
Thank you in advance for your help!

Vitaly91 wrote:
I have a Solaris-based SRSS 4.2 installation. I have Global Kiosk set to connect to VMware View server (and it works fine).
I created another Kiosk configuration using the Kiosk Mode Generic Session (http://wiki.sun-rays.org/index.php/SRSS_Addon:_Kiosk_Mode_Generic_Session)
My generic.conf looks like this:
KIOSK_SESSION_EXEC=$KIOSK_SESSION_DIR/generic-session
KIOSK_SESSION_LABEL="SGD"
KIOSK_SESSION_DESCRIPTION="Provides an SGD X session for running a Kiosk script."
KIOSK_SESSION_ARGS="/usr/bin/firefox http://sgdserver/sgd"
KIOSK_SESSION_PROTOTYPE=generic-session
I have then ran these commands to import the configuration and assign it to certain users:
# utkiosk -i SGD -f generic.confUnfortunately Kiosk has two kinds of *.conf files: session descriptors (see the kiosk(5) man page) and session configurations (see the session.conf(4) man page). And these types are rather similar - some settings can be in the descriptor as default, but also in the session configuration. The generic.conf you have is a session descriptor. Those must be stored into /etc/opt/SUNWkio/sessions/. But for import into utkiosk you need a session configuration. Probably utkiosk should do more validation of the configuration you are importing to protect against this confusion.
The generic session is intended for configuring any command to be executed from the admin UI. If you know your command and need a prototype, you should go the extra step and make a specific session. Here is how:
Rename your file to /etc/opt/SUNWkio/sessions/SGD.conf and change it to be:
KIOSK_SESSION_EXEC=/usr/bin/firefox
KIOSK_SESSION_LABEL=SGD
KIOSK_SESSION_DESCRIPTION=Provides an SGD X session for running a Kiosk script.
KIOSK_SESSION_PROTOTYPE=SGDAlso rename your /etc/opt/SUNWkio/prototypes/generic-session directory to /etc/opt/SUNWkio/prototypes/SGD, as per the last line above.
You can leave the KIOSK_SESSIONS_ARGS line in the file, if you wish, but it will just be a default, so I'll show how to set the arguments via utkiosk.
To verify that you have set up the descriptor correctly, use
/opt/SUNWkio/bin/kioskdesc print SGD Now create your session configuration:
# utkiosk -i SGD <<!
KIOSK_SESSION=SGD
KIOSK_SESSION_ARGS=http://sgdserver/sgd
! Of course you can also put these two lines into a file and use it with the -f argument to utkiosk.

Invalid Portal Session

While browsing through the forums, I got the message below :
Invalid Portal Session*
An error was encountered while processing your Portal request, because your portal session is no longer valid. You have been logged out and you will automatically be redirected to the OracleAS Portal home page in 30 seconds. Click OracleAS Portal home page to go directly to the OracleAS Portal home page, or if your browser does not automatically redirect you. If you continue to have problems while accessing OracleAS Portal, close all your browser instances and try again.
Nicolas.

user11945767 wrote:
Hello,
In our case, I have tried Opera, Safari, Chrome and Mozilla browsers and none of them show 'Invalid Portal Session' error. It only occurs with Microsoft Internet Explorer. And this happens consistently with IE. Not a single time it succeeds unless F5/Refresh is hit.
What could be the reason for this and how can it be resolved. We are running Oracle 10.1.2 AS.
Thanks.Nicolas asked the question about the Oracle Forums. Since this is a Forums Community issue, he correctly asked it in the "Community Feedback and Suggestions (Do Not Post Product-Related Questions Here)" Forums area.
You seem to be asking the question about the Oracle Application Server Portal product. Even though it appears your question and Nicolas' may be related, you are probably asking the question in the wrong area.
Your question is likely better asked
1) of Support (by opening a service request) and/or
2) asking in http://forums.oracle.com/forums/category.jspa?categoryID=193 and/or
3) asking in http://forums.oracle.com/forums/category.jspa?categoryID=196

Invalid vi session

Hi,
I am using PX-1042 system with the power supply NI PXI-4110. I initialize the supply in the start of the program which works fine, but as soon as the cotrol goes into the block where it reads the Voltage and Current continuesly, an error window occurs which says.
"Error -1074130544 occurred at niDCPower Measure Multiple.v"
"Possible reason(s):Invalid VI session."
In this block, I don't initialize the Power Supply again as I have done it already. I have also attached the whole code here. Any one please give me the solution to get rid of this error code.
Regards,
Mansoor
Solved!
Go to Solution.
Attachments:
OWI_Operation.vi ‏242 KB

You are not using the instrument handle that was created when you initialized the instrument. Instead you are using the VISA resource name. That is not the same as the handle. You should be using the purple wire called handle coming from your initialization VI, not the VISA resource constant.
There are also a few odd things going on. Don't use a value property node for measurement when you have the terminal available. Also, your false constants wired to the while loops means the only way you can stop the VI is by aborting it. You could also merge your two different event structures into one.

IMAQdx: Invalid camera session

I want to use GigE camera on LabVIEW2011.
I have already installed Vision Acquisition software (ver Aug 2012) and got image on NI MAX.
But on LabVIEW2011, I could not get image. Error was occured as follows.
Error code 1074360315 was occured
on IMAQdx Get Image.vi
NI-IMAQdx: (HEX 0xBFF69004) Invalid camera session
Please help me.

Hi wmaker,
For your information, this is japanese discussion forum, it might be useful for you to use English boards like here;
Machine Vision Board.
http://forums.ni.com/t5/Machine-Vision/bd-p/200

Possible reasons for error 1074396005 invalid avi session

Dear All,
I am working on creating and writing frames on to AVI files. I need to start writing frames up on record on command and close the AVI file up on record stop command. I am trying to read frames from an recorded video and write in to another AVI file.
But i am observing Error 1074396005 invalid avi session, whenever i run the code. I am using AVI2 VI's (IMAQ AVI2 Create, AVI2 Write and AVI2 close).
I am using LabVIEW 2013 SP1 and Vision development module versions.
Below is the block diagram for reading an avi file and writing in to avi file upon record on command (numeric control value 1 to case selector)
Block diagram for record off
Below is the error observed:
Kindly suggest what would be the possible reason for the error.
With regards,
Sri
Attachments:
Block diagram1.PNG ‏59 KB
avi2 error2.png ‏381 KB
Block diagram2.PNG ‏20 KB

Might be good if you can post the code instead of screenshots.
-If session was closed or aborted due to some reason you should get this error.
-Multiple times you are creating the session inside the loop with same avi session, is it required?
-Are the images added to the avi file?
Thanks
uday,
Please Mark the solution as accepted if your problem is solved and help author by clicking on kudoes
Certified LabVIEW Associate Developer (CLAD) Using LV13

Invalidating a session in Java Bean

Hi,
I need to write a logout() method in my Java Bean to invalidate
the current session upon logout.
But i keep getting error when i try to access the session.
bu using
session.invalidate();
Does anyone know how to retrieve the current session in a Java Bean??
Thanks..

Hi,
You can pass the session from the JSP to the Javabean method for invalidating it. For example, in your JSP you can have:
<%-- instantiate your bean --%>
<jsp:useBean id="bean" class="YourJavaBean" scope="page" />
<%-- call the method with the session parametere --%>
bean.logout(session);
And then in your bean, have:
public void logout(HttpSession session) {
//Any processing...
//invalidate the session
session.invalidate();
Hope that helps,
Srinivas

Invalid HTTP session

In my web application, I use session object to carry variables cross pages. After the data is no longer need, I call
          session.invalidate();
          session = request.getSession(true);
          to invalid the old session and open a new one.
          The problem here is that oftenly, I will get a error saying:
          java.lang.IllegalStateException: HttpSession is invalid
          It happens when I am trying to set or get certain Attribute from the session object. I cannot find out what the problem here is. Any help will be greatly appreciated!
          By the way, I am using WebLogic 8.1 with service pack 2.


session.invalidate() does not remove the actual session; It just marks it as
          invalid.
          So, you should remove all attributes from the session and keep using the
          same session again (instead of creating a new one).
          for(Enumeration enum = session.getAttributeNames() ; enum.hasNext() ; )
          session.removeAttribute((String)enum.next()) ;
          Eventhough, it is a little expensive in performance, it will work for sure
          Thanks,
          Selva-
          "Clare" <[email protected]> wrote in message
          news:3f8ca9e8$[email protected]..
          > In my web application, I use session object to carry variables cross
          pages. After the data is no longer need, I call
          > session.invalidate();
          > session = request.getSession(true);
          > to invalid the old session and open a new one.
          > The problem here is that oftenly, I will get a error saying:
          >
          > java.lang.IllegalStateException: HttpSession is invalid
          >
          > It happens when I am trying to set or get certain Attribute from the
          session object. I cannot find out what the problem here is. Any help will be
          greatly appreciated!
          >
          > By the way, I am using WebLogic 8.1 with service pack 2.

Validating and invalidating a session

I now have a login jsp working and when the user enters the right username and password the user will be directed to the appropriate page. I have included the following code in each of my pages to prevent caching:
<%
response.setHeader("Cache-Control","no-cache,no-store,must-revalidate");
response.setHeader("Pragma","no-cache");
response.setDateHeader ("Expires", -1);
response.setIntHeader("max-age", 0);
response.addHeader("cache-Control", "private");
%>
I also have a logout jsp where I invalidate the session which looks like this:
<body>
<% request.getSession().invalidate();%>
<% response.sendRedirect(response.encodeRedirectUrl("login.jsp"));
</body>
I continue to have problems in that if the user once loggin out and going the an invalidation in the logout.jsp, they are still able to reload the admin page by pressing the IE browser BACK button and then clicking on REFRESH.
Could someone please let me know how to properly validate and invalidate the session and where I should do this (which JSP)???
I want to make sure that there is no way possible to get back to that admin page once the user has logged out. With the exception of loggin back in of course.
Thank you.

You should use POST actions, and all problems solved.

Invalidating a Session help

When a user logs out the following servlet is called. The problem is that when the back button is hit they can get back in without signing in again. User authentication is done with a bean with Session scope. Does the invalidate() not destroy the bean as well?
import java.io.*;
import javax.servlet.ServletException;
import javax.servlet.http.*;
public class LogOutServlet extends HttpServlet
     protected void doGet(HttpServletRequest request,
     HttpServletResponse response) throws ServletException, IOException {
     HttpSession hs;
     hs=request.getSession();
     hs.invalidate();
     response.sendRedirect("../index.jsp");
help me OB1, you're my only hope.
Thanks
C.

Well, you don't clear the cache, you prevent pages from being cached.
Look at this thread: http://forum.java.sun.com/thread.jsp?forum=45&thread=562372 which states clearly how to do it. Note, you would have to add the response.setHeaders on top of every page that you don't want cached.

How can I invalide the session automatically while user close IE browser

I have tried to add onUnload function to javascript, but it seems it doesn't call when user close the browser. Anyone could offer me suggestions?

Crosspost: http://forum.java.sun.com/thread.jspa?threadID=5179905

Invalidating a session

Similar Messages

Maybe you are looking for