Sign Out Function

[Luke Shannon]

I have an application that requires you to log-in. Authentication is done using Tomcat JDBC Security Realm.

My question is how can I create a function that allows someone to logout, meaning their session is killed and if they want to hit the login screen wishing to login under a new profile they will have that chance and not be immediately authenticated.

Thanks,

Luke

[Keith Pitty]

Use a servlet for the purpose of logging out and in that servlet invalidate the session. For example:

public class LogoutServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
        throws ServletException, IOException {
 
        HttpSession session = req.getSession(false);
        if (session != null) {
            session.invalidate();
        }
        getServletContext().getRequestDispatcher("/Login.jsp").forward(req, resp);
    }
}

[ September 27, 2005: Message edited by: Keith Pitty ]

[David O'Meara]

'Removing authentication details' is different depending on the container you are using, but Keith's code will work in Tomcat.

[Wally Hartshorn]

I've just started tackling this exact same problem and came across this thread. I've created the servlet as suggested, but after logging out, when I try to log in again, I get this error message in my browser:

<servlet>
<servlet-name>Logout</servlet-name>
<servlet-class>com.sample.Logout</servlet-class>
</servlet>
 
<servlet-mapping>
<servlet-name>Logout</servlet-name>
<url-pattern>/logout.do</url-pattern>
</servlet-mapping>

<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.html</form-login-page>
<form-error-page>/login-error.html</form-error-page>
</form-login-config>
</login-config>
 
<security-role>
<role-name>parrot</role-name>
</security-role>
 
<security-constraint>
<web-resource-collection>
<web-resource-name>ParrotGame</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<http-method>GET</http-method>
<http-method>POST</http-method>
<auth-constraint>
<role-name>parrot</role-name>
</auth-constraint>
</security-constraint>

Here's Logout.java:

package com.sample;
 
import javax.servlet.*;
import javax.servlet.http.*;
 
import java.io.*;
 
public class Logout extends HttpServlet {
 
    private static final long serialVersionUID = -2507617092541077114L;
 
    public void doPost (HttpServletRequest request,
            HttpServletResponse response) throws IOException, ServletException {
 
        HttpSession session = request.getSession(false);
 
        if (session != null) {
            session.invalidate();
        }
        
        getServletContext().getRequestDispatcher("/login.html").forward(request, response);
}
}

Any suggestions on what I'm doing wrong?
[ September 30, 2005: Message edited by: Wally Hartshorn ]

[David O'Meara]

Just to be sure: I'm assuming the different Logout form mapping and code sample package doesn't have anything to do with it?

[Wally Hartshorn]

Originally posted by David O'Meara:
Just to be sure: I'm assuming the different Logout form mapping and code sample package doesn't have anything to do with it?

Nah, that was just a mistake in my cutting/pasting and editing of the message.

After posting my message, I wondered whether the fact that my login page was named "login.html" (rather than "login.jsp") would have something to do with it. So I tried renaming the file to "login.jsp" (even though it doesn't currently have any JSP code in it) and made the corresponding changes to the web.xml and Logout.java code. Then when I logged out, I got this message:

HTTP Status 400 - Invalid direct reference to form login page

Okay, so apparently trying to go directly to login.jsp is a no-no. So I changed my Logout.java code to forward to the main page of the web app, on the assumption that it would instead redirect to display the login page. Instead, it displayed the main page, but would not display an image that was on the page. Apparently, since the Logout servlet said to display the page, that was allowed, but none of the stuff requested by that page would be allowed until the user logged in.

Hmm... Still stuck! Any ideas?

[Wally Hartshorn]

I think I just solved my problem.

In my Logout.java class, I changed this:

getServletContext().getRequestDispatcher("/index.jsp").forward(request, response);

to this:

response.sendRedirect("index.jsp");

For whatever reason, that seems to have done the trick! I got the idea from this snippet in Tomcat's "webapps\jsp-examples\security\protected\index.jsp" code:

<%
  if (request.getParameter("logoff") != null) {
    session.invalidate();
    response.sendRedirect("index.jsp");
    return;
  }
%>

Here's the final Logout.java class:

package com.sample;
 
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
 
public class Logout extends HttpServlet {
 
    private static final long serialVersionUID = -2507617092541077114L;
 
    public void doPost (HttpServletRequest request,
            HttpServletResponse response) throws IOException, ServletException {
 
        request.getSession().invalidate();
        
        response.sendRedirect("index.jsp");
    }
}

(If anyone sees any "gotchas" to this method, please let me know!)

Thanks for your time!

[David O'Meara]

OK, you're quite right. The original problem is a bit convoluted and I'm not sure I understand it myself (interaction between Struts, Post and the RequestDispatcher) but good job for solving it and thanks for the update.

[Srinivasa Kadiyala]

I have used this code for one of my applications and notced that after I log-out, when I click the browser back button, the previous page when I logged-on is appreaing.
It should not if I log out and killing the session.

Pl help.

[David O'Meara]

Please start a new thread and provide a link refering to this thread. The original problem has been solved and people are less likely to join the conversation and help you out.

thanks,
Dave