I'm newbie of Spring Security and I have problem with expire user session.
In my application, there are administrator with ROLE_ADMIN and they can change other users role.
I want to expire the session of user whose authority is changed by administrator.
I found that I can get all logged-in users session by using SessionRegistry.
I checked that I can get all SessionInformation with sessionRegistry.getAllSessions() and I tried to expire session information with below codes.
List<SessionInformation> sessionInformations = sessionRegistry.getAllSessions(allPrincipals.get(i), false);
for (SessionInformation information : sessionInformations) {
information.expireNow();
sessionRegistry.removeSessionInformation(information.getSessionId());
}
allPrincipals.set(i, new AccountUserAdaptor(requestedAccount));
I thought above code is enough to expire session of specific other user.
But in SecurityContextPersistenceFilter authentication is recovered from session which I thought it already expired.
I checked that with request.getSession() I can get valid session which I thought was already expired. Even SessionID in information.getSessionId() and request.getSession() is same.
I want to know why session is not expired.
I'm using Spring(not Spring-Boot)