Add HttpSessionListener Support

[rwinch]

Consider adding HttpSessionListener Support.

Depending on the implementation this may be impossible to reliably support. For example, while we can receive expiration notifications from Redis, there are no guarantees on when the expiration event will be sent.

Depends On #45

[aravindanr]

@rwinch Any plans to support this for MapSession. Currently, I am using MapSession with Spring Security. Since the Session events are not published, the Spring Security Session Management does not work correctly. Destroyed sessions do not get removed from SessionRegistry. To fix this, i am manually publishing the event in a LogoutHandler.

For my use case, if at least MapSession publishes appropriate events, it would be beneficial.

[rwinch]

@aravindanr Typically MapSessionRepository (in particular when using a HashMap) is used for testing purposes due to the fact that it does not work across a cluster.

MapSessionRepository can be used in a cluster when using a distributed Map implementation (i.e. Hazelcast). However, to support session timeouts is very implementation specific so it is unlikely we will be able to support HttpSessionListener in the generic MapSessionRepository.

If HttpSessionListener support cannot be implemented could you consider at least firing Spring Security's HttpSessionCreatedEvent and HttpSessionDestroyedEvent ? Those are helpful to build an in-memory list of HttpSession objects by session id, which I'd like to use in a custom implementation of Spring Security session management own ConcurrentSessionControlAuthenticationStrategy that invalidates sessions on the spot.

Without those two, I can retrieve Spring Session's Session or ExpiringSession objects (wiring SessionRepository in) but then I can't invalidate the session as those objects do not have an invalidate() method.

[making]

👍

Unless HttpSessionListener and HttpSessionAttributeListener is supported, documenting alternative solutions is helpful and required.

org.springframework.context.ApplicationListener for org.springframework.session.events.SessionDestroyedEvent is alternative of javax.servlet.http.HttpSessionListener#sessionDestroyed?

The following methods look working:

• javax.servlet.http.HttpSessionListener#sessionCreated
• javax.servlet.http.HttpSessionAttributeListener#attributeAdded

[making]

javax.servlet.http.HttpSessionBindingListener dose not seem to work.
So org.springframework.web.context.request.DestructionCallbackBindingListener doesn't work.
This means @PreDestroy annotated session scoped bean doesn't work, right?

[paskos]

👍
We don't have requirement for clustering and use MapSessionRepository as bridge between HttpSessionand WebSocketSessionand we'd like to have metrics on active sessions but HttpSessionListeneris not supported.

[rwinch]

@paskos NOTE: You can get active sessions by querying Redis instead

[paskos]

We don't use Redis because we don't need clustering, we use MapSessionRepository

[praveen12bnitt]

+1

[bmorris591]

+1 from me.

We use the SessionDestroyedEvent to get information about the user. This information is stored in a "login history table" - so we need the information stored on the Session to build the data.

Happy to use a workaround - but cannot think of one at the moment...