Forum:

Killing session when closing the browser

Ranch Hand

Posts: 518

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Hi,

I am trying to kill the session when closing the browser without logging out properly. But i am unable to kill the session. I am posting the code

index.jsp:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<title>PEOPLETECH PROGRESSIVE CRM LOGIN</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<link href="/TestLogin/css/style.css" rel="stylesheet" type="text/css">
</head>
<script language="JavaScript">
function validate () 
{
if (document.Login.Username.value == "") 
{
	alert("Please enter your Username."); 
	document.Login.Username.value ="";
	document.Login.Username.focus();	
	return false;
}
else if (!isNaN(document.Login.Username.value)) 
{
	alert("Please enter Character Format of Username.");
	document.Login.Username.value="";
	document.Login.Username.focus();
	return false;
}
else if (document.Login.Password.value == "") 
{
	alert("Please enter your Password.");
	document.Login.Username.value="";
	document.Login.Password.focus();
	return false;
}
login();
return true;
}

function login()
{
document.Login.action="UsingSession";
document.Login.method=post;
document.Login.submit();
}
</script>

<body>

<tr>
						<td><img ></img></td>
						<td></td>				
					</tr>
					
				</table>
				</div>
				<b class="bc"><b class="L3"></b><b class="L2"></b><b class="L1"></b></b></div>
			
		</table>
	</td>
  </tr>
  <tr >
  <td>
  	<table border="0"    >
  		<tr><td >
    	<div class="box"><b class="tc"><b class="L1"></b><b class="L2"></b><b class="L3"></b></b>
		<div class="content">
			<table border="0"    >
				<tr ><td   class="txt3"> </td></tr>
				<tr>
					<td >User Name</td><td><input type="text" class="inpbox" name="Username" /></td>
				</tr>
                <tr>
					<td >Password</td><td><input type="password" class="inpbox" name="Password" /></td>
				</tr>
			
                <tr><td  ><input type="submit" value="Login" class="buttons" onclick="validate()"/></td></tr> 
                            
			</table>
		</div>
		<b class="bc"><b class="L3"></b><b class="L2"></b><b class="L1"></b></b></div>
    </td></tr>
  	</table>
  </td>
  </tr>
  <tr class="footbg">
    <td >
		<table  border="0"  >
            <tr>
              <td  class="foottxt">Copyright @ 2010 PeopleTech Systems. All Rights Reserved.</td>                            
            </tr>
        </table>
	</td>
  </tr>
</table>
</form>
</body>
</html>

UsingSession.java:

public class UsingSession extends HttpServlet 
{

public void doGet(HttpServletRequest request, HttpServletResponse response) 
        throws ServletException, IOException 
    {
        response.setContentType("text/html");
        PrintWriter out = response.getWriter();

HttpSession session = request.getSession(true);

Integer counter = (Integer) session.getAttribute("counter");

if (counter == null) {
            counter = new Integer(1);
        } else {
            counter = new Integer(counter.intValue() + 1);
        }

session.setAttribute("counter", counter);

out.println("<HTML>");
        out.println("<HEAD>");
        out.println("<TITLE>");
        out.println("Using Sessions");
        out.println("</TITLE>");
        out.println("</HEAD>");
        out.println("<script language='JavaScript'>");
       // out.println("window.onbeforeunload = confirmExit");

out.println("function confirmExit()");
        out.println("{");
        //out.println("<%Session.abandon()%>");
        out.println("alert('Do you want close the Preview Dialer CRM Page.?')");
        out.println("document.Login.action='Logout'");
        out.println("document.Login.method='get'");
        out.println("document.Login.submit()");
        out.println("}");
        out.println(" </script>");
        out.println("<BODY onbeforeunload = confirmExit()>");
        out.println("<form name='Logout' action='Logout' method='get'>");
        out.println("<H1>Using Sessions</H1>");

out.println("Welcome! You have been here " + counter + " times.<BR>");

if(session.isNew()){
            out.println("This is a new session.<BR>");
        } else {
            out.println("This is not a new session.<BR>");
        }

out.println("The session ID: " + session.getId() + "<BR>");
        out.println("Last time accessed: " + new Date(session.getLastAccessedTime()) + "<BR>"); 
        out.println("Creation time: " + new Date(session.getCreationTime()) + "<BR>");
        out.println("Timeout length: " + session.getMaxInactiveInterval() + " seconds<BR>");
        out.println("<td><input name='logout' type='submit' value='Logout' class='buttons'/></td>");
        out.println("</form>");
        out.println("</BODY>");
        out.println("</HTML>");
    } 
}

Logout.java

import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

/**
 * Servlet implementation class for Servlet: Logout
 *
 */
 public class Logout extends javax.servlet.http.HttpServlet implements javax.servlet.Servlet {
   static final long serialVersionUID = 1L;
   
    /* (non-Java-doc)
	 * @see javax.servlet.http.HttpServlet#HttpServlet()
	 */
	public Logout() {
		super();
		System.out.println("dfdsfsdf");
		
	}   	
	
	/* (non-Java-doc)
	 * @see javax.servlet.http.HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
	 */
	protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
		// TODO Auto-generated method stub
		HttpSession session;
		System.out.println("insideeeeeeeeeee");
		 session=request.getSession(true); 
		 request.getSession(true).invalidate();
		System.out.println( "sessssssssss"+session.getId());

}  	
	
	/* (non-Java-doc)
	 * @see javax.servlet.http.HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
	 */
	protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
		// TODO Auto-generated method stub
	}   	  	    
}

Please assist me to do this.

Thanks

Ulf Dittmer

Rancher

Posts: 43081

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

While you didn't say what's happening and what is or is not working, I'm curious what the reason for wanting to invalidate the session is. It happens automatically after whatever period is set in the web app anyway; is there a need to accelerate that process?

preethi Ayyappan

Ranch Hand

Posts: 518

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Thanks for your reply. If the user closes the browser without logging out properly, Their session has not been killed and if they try to login again they are not able to login to the form. We need to restart the tomcat again. To overcome this I am trying to accelarate the session kill function to kill the session which logs out properly. Am i doing wrong? Is there any other way to solve this?

Bear Bibeault

Sheriff

Posts: 67752

173

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Let the session timeout do its thing.

[Asking smart questions] [About Bear] [Books by Bear]

HTML 5 (verified skill)
Skill verified by Jeanne Boyarsky

CSS 3 (verified skill)
Skill verified by Jeanne Boyarsky

JavaScript (verified skill)
Skill verified by Jeanne Boyarsky

Ulf Dittmer

Rancher

Posts: 43081

posted 13 years ago

1
Number of slices to send:

Optional 'thank-you' note:

Send

If you need to restart Tomcat then you're definitely doing something wrong.

If a session already exists, then the user should not need to log in again. The web app should not even show the login page to anyone who is logged in already.

Sudhakar Sharma

Ranch Hand

Posts: 71

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Ulf Dittmer wrote:If you need to restart Tomcat then you're definitely doing something wrong.

If a session already exists, then the user should not need to log in again. The web app should not even show the login page to anyone who is logged in already.

Ulf Dittmer told you right and the way how it should work.
But if you really want to kill the session whenever, user closes his browser, you need to go through javascript, because server has no idea of this event.

Bear Bibeault

Sheriff

Posts: 67752

173

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Sudhakar Sharma wrote:But if you really want to kill the session whenever, user closes his browser, you need to go through javascript, because server has no idea of this event.

Neither does JavaScript.

[Asking smart questions] [About Bear] [Books by Bear]

Jessid Leon Velez Gutierrez

Ranch Hand

Posts: 35

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Hello. I understand that there are better ways to solve what you are trying to do. Nevertheless here is a very simple idea (Please, if I am wrong, someone correct me):

in the login jsp you could use a little code like this to kill your session. If you do it, you assure that the user is not in session when the browser is closed, but when the user is trying to re-login:

<% request.getSession().invalidate(); %>

Bear Bibeault

Sheriff

Posts: 67752

173

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Scriptlets in 2011?

In any case, visiting a login page is not the same a closing the browser.

[Asking smart questions] [About Bear] [Books by Bear]

Sudhakar Sharma

Ranch Hand

Posts: 71

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Bear Bibeault wrote:

Sudhakar Sharma wrote:But if you really want to kill the session whenever, user closes his browser, you need to go through javascript, because server has no idea of this event.

Neither does JavaScript.

Can't we use javascript to send another request, when browser is closed, to a servlet that is responsible for invalidating the session.
or
the code inside javascript

then how we invalidate the session immediately after the user closes his browser? Please help

William Brogden

Author and all-around good cowpoke

Posts: 13078

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Won't work because the user may be looking at a completely different tab when he closes the browser.

Face Facts - there is no certain way of detecting that the user just closed the browser.

Therefore - you will have to depend on the built in mechanisms to time-out the session.

Bill

Tuna Töre

Ranch Hand

Posts: 220

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Bear Bibeault wrote:Scriptlets in 2011?

In any case, visiting a login page is not the same a closing the browser.

Which Java Technology you offer other than Scriptles in 2011 ???

blog: http://tunatore.wordpress.com

https://www.udemy.com/spring-framework-4-course-and-core-spring-certification/?couponCode=spring39coupon

Core Spring Certified Professional + SCJP 6.0 + SCWCD 1.5

Bear Bibeault

Sheriff

Posts: 67752

173

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Tuna Töre wrote:

Bear Bibeault wrote:Scriptlets in 2011?
Which Java Technology you offer other than Scriptles in 2011 ???

The JSTL and EL where introduced with JSP 2.0 in 2002! That's almost 10 years ago.

Scriptlets in JSP have been discredited since then -- long since time to move on!

[Asking smart questions] [About Bear] [Books by Bear]

Tuna Töre

Ranch Hand

Posts: 220

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

preethi Ayyappan wrote:Thanks for your reply. If the user closes the browser without logging out properly, Their session has not been killed and if they try to login again they are not able to login to the form. We need to restart the tomcat again. To overcome this I am trying to accelarate the session kill function to kill the session which logs out properly. Am i doing wrong? Is there any other way to solve this?

You should get the session in every jsp pages in the correct way and after getting session correctly, system app. users can use the system without having problem and dont need to login for the second time to server. Moreover you dont neet to restart the Tomcat App. Serv.

There is an example jsp code to get the user session;

As far as I know, there is no way to call a Servlet Method by detecting browser close event. Forexample; in many Banking applications you should see a button to close the Session in a secure way. The user should click this button to close the session or the session times-out by server.

Paul Sturrock

Bartender

Posts: 10336

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

As far as I know, there is no way to call a Servlet Method by detecting browser close event. Forexample; in many Banking applications you should see a button to close the Session in a secure way. The user should click this button to close the session or the session times-out by server.

There is a way to do it - you hook into the window.onunload event. However, saying something can be done and something should be done are different things. This will only work if the browser is closed normally. So if the process is killed, the browser crashes, the browser has JavaScript disabled or the plug is pulled from the client machine no request will be sent. So relying 100% on this method to invalidate the session is foolish.

JavaRanch FAQ HowToAskQuestionsOnJavaRanch

Bear Bibeault

Sheriff

Posts: 67752

173

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Moreover, the onunload handler is called whenever a page is unloaded. So there is no way to tell the difference between the browser being closed, and simply navigating to a new page.

[Asking smart questions] [About Bear] [Books by Bear]

Stefan Evans

Bartender

Posts: 1845

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Tuna Töre wrote:
There is an example jsp code to get the user session;

<% // Get the session object // a new session object. HttpSession session = request.getSession(false); //check session obj is NULL or not here ***** } %>

OR you could just use the implicit variable "session" already defined for you on the JSP. Your choice.

Regarding detecting a closed browser, the only way is client side. The server can't distinguish between a browser that is closed, and a browser that is just no longer sending requests.
The window.onunload event detection is a possible solution, if a bit hacky.
The suggestion I have seen is to use a frameset with two frames. The 'main' frame displays your app, and the second frame is of size 0, and is where you put the window.onunload event. So you will only trigger the onunload event if you completely leave your app, or close the browser window.

Of course whether the onunload event manages to send a "I am closing" event to the server before being closed is another matter.

What's a year in metric? Do you know this metric stuff tiny ad?

Smokeless wood heat with a rocket mass heater

https://woodheat.net