How to invalidate session in JSF 2.0?

Question

What is the best possible way to invalidate session within a JSF 2.0 application? I know JSF itself does not handle session. So far I could find

private void reset() {
    HttpSession session = (HttpSession) FacesContext.getCurrentInstance()
            .getExternalContext().getSession(false);
    session.invalidate();
}

1. Is this method correct? Is there a way without touching the ServletAPI?
2. Consider a scenario wherein a @SessionScoped UserBean handles the login-logout of a user. I have this method in the same bean. Now when I call the reset() method after I'm done with necessary DB updates, what will happen to my current session scoped bean? since even the bean itself is stored in HttpSession?

Footboy

Answer 1

Firstly, is this method correct? Is there a way without touching the ServletAPI?

You can use ExternalContext#invalidateSession() to invalidate the session without the need to grab the Servlet API.

@ManagedBean
@SessionScoped
public class UserManager {

    private User current;

    public String logout() {
        FacesContext.getCurrentInstance().getExternalContext().invalidateSession();
        return "/home.xhtml?faces-redirect=true";
    }

    // ...

}

---

what will happen to my current session scoped bean? since even the bean itself is stored in HttpSession?

It will still be accessible in the current response, but it will not be there anymore in the next request. Thus it's important that a redirect (a new request) is fired after invalidate, otherwise you're still displaying data from the old session. A redirect can be done by adding faces-redirect=true to the outcome, as I did in the above example. Another way of sending a redirect is using ExternalContext#redirect().

public void logout() throws IOException {
    ExternalContext ec = FacesContext.getCurrentInstance().getExternalContext();
    ec.invalidateSession();
    ec.redirect(ec.getRequestContextPath() + "/home.xhtml");
}

Its use is however questionable in this context as using a navigation outcome is simpler.

Quinby

@BalusC, what's the difference between ExternalContext#invalidateSession() and HttpSession#invalidate()? – Gravamen

@Patrick: Functionally, nothing. They both do exactly the same. ExternalContext#invalidateSession() calls under the covers HttpSession#invalidate() (see also the javadoc link in my answer). Design-technically, the ExternalContext approach is better. You should basically strive to have zero javax.servlet.* imports in any of your JSF related artifacts. – Quinby

What about a SSL session? Is it possible to invalidate it? Because I tried unsuccessfully via the suggested method – Mobile

Answer 2

public void logout() {
    FacesContext.getCurrentInstance().getExternalContext().invalidateSession();
}

Cassiecassil

Answer 3

With a "normal" redirect I ended up with a login form (where I was redirecting to) which was not working. I ended up doing a JavaScript update of the document href. Using OmniFaces it's looking like this:

if (!Faces.isAjaxRequest()) {
  throw new FacesException("Ajax request is required");
}
// ... Do logout from your security manager here (we use Shiro)
Ajax.oncomplete("document.location.href='" + url + "'");

Longshoreman

Answer 4

Frontend code is:

<h:form>
<h:commandLink action="#{userManager.logout()}">
       <span>Close your session</span>
</h:commandLink>
</h:form>

Backend code is:

public String logout() {
    HttpSession session = (HttpSession) FacesContext.getCurrentInstance().getExternalContext().getSession(false);
    if (session != null) {
        session.invalidate();
    }
    return "/login.xhtml?faces-redirect=true";  
}

Chilon