Is it possible to invalidate a spring security session?

Question

I\'m using Tomcat 6.0.32, Spring Security 3.0.5

In my web app some users have the ability to change other users privileges. When this happens I would like to invali

Answer 1

Assuming you are running your app on multiple servers you are going to need to have a way to make this happen on all the servers.

1. Add a timestamp field to your user table (or equivalent) that is updated when a user prvis are changed.

2. Write a servlet filter that checks if the current session is authenticated AND the timestamp for the user in the DB is greater than the session's creation time. If so invalidate the session and redirect somewhere.

This filter will need to come after the Spring Security filter.

If you are not running your app on multiple servers then you can use SessionRegistry.