Logout idle user automatically when HTTP session expires #6380
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
solth
changed the title
solth
force-pushed
the
automatic-logout
branch
from
5295ffb to
f0dcee8
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request restores the correct handling of HTTP sessions being destroyed and thus fixes #6372 .
Expired HTTP sessions were previously handled by the
KitodoVersionListener, which was the wrong place for this particular event handling and was then supposed to be moved toSessionServiceby #6047, but that pull request was missing a required annotation and therefore broke the handling of expired sessions.#6379 adds the missing annotation to
SessionService, but a service class is the wrong place for this in my opinion, so I opted to add a dedicatedCustomHttpSessionListenerthat extendsHttpSessionListenerand does this job instead.This pull request also adds a message shortly before the user is logged out automatically, to inform him about the pending, automatic logout, that contains a timer with the remaining time until the automatic logout:
This makes use of the PrimeFaces IdleMonitor component and the Timer component of PrimeFaces Extensions.
By also clearing the metadata locks of processes opened by a user in the metadata editor upon automatic logout, this pull request resolves #4480 as well.