How to expire other users session in Spring Security

Viewed 255

I'm newbie of Spring Security and I have problem with expire user session.
In my application, there are administrator with ROLE_ADMIN and they can change other users role.

I want to expire the session of user whose authority is changed by administrator.
I found that I can get all logged-in users session by using SessionRegistry.

I checked that I can get all SessionInformation with sessionRegistry.getAllSessions() and I tried to expire session information with below codes.

List<SessionInformation> sessionInformations = sessionRegistry.getAllSessions(allPrincipals.get(i), false);

for (SessionInformation information : sessionInformations) {
    information.expireNow();
    sessionRegistry.removeSessionInformation(information.getSessionId());
}

allPrincipals.set(i, new AccountUserAdaptor(requestedAccount));

I thought above code is enough to expire session of specific other user.
But in SecurityContextPersistenceFilter authentication is recovered from session which I thought it already expired.

I checked that with request.getSession() I can get valid session which I thought was already expired. Even SessionID in information.getSessionId() and request.getSession() is same.

I want to know why session is not expired.

I'm using Spring(not Spring-Boot)

0 Answers
Related