fastest way to kick user out

[Heather Buch <hb...@www.thebuchs.dk>]

Hi,

I have two tomcat webapps, both of which use struts.

The first webapp is for students. A student can log in and edit his class
schedule.

The second webapp is for administrators. An admin can log in and approve or
reject student schedules.

If the admin logs in to start approving/rejecting, I need an immediate way to
kick all students out and give them an instantaneous error message explaining
that their session is being killed and unsaved changes will be lost. I'm not
sure what the best way to do this is. 

Currently, I have this solution: I have a StudentService class as the
interface between the servlets and the business objects. The StudentService
contains "rough-grained" methods that get stuff in and out of the database.
Before any of these database access methods get executed, I check to see if
there is an administrative lock.

But this doesn't seem quite secure enough. What if the adminstrator should
login after the student has done the adminlock check but before they have
written to the database? I guess I could use synchronized objects, but that
might be overkill as my applications are pretty small and simple. If there was
some way for the administrator just to kick all the students out the moment
she logged in (maybe by throwing an event), that would be ideal. Is there some
way to do this?

thanks,

Heather Buch



Heather Buch


---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org

RE: fastest way to kick user out

[Robert Taylor <rt...@mulework.com>]

One solution:

When the admin logs in, place a "lock-out" token in the students
ServletContext.
Have all student requests (using a filter) check for that token. If it
exists, then
kill the current student session and display a message to the student. When
admin is done,
remove "lock-out" token from students ServletContext.

You can get the ServletContext from another web app using
ServletContext.getContext().
This does require that the admin web app have knowledge about the student
web app. Not
really considered a best-practice, but in this case, I'm not so sure this is
a "bad" thing.

HTH,

robert

> -----Original Message-----
> From: Heather Buch [mailto:hbuch@www.thebuchs.dk]
> Sent: Monday, May 05, 2003 5:30 AM
> To: struts-user@jakarta.apache.org
> Subject: fastest way to kick user out
>
>
> Hi,
>
> I have two tomcat webapps, both of which use struts.
>
> The first webapp is for students. A student can log in and edit his class
> schedule.
>
> The second webapp is for administrators. An admin can log in and
> approve or
> reject student schedules.
>
> If the admin logs in to start approving/rejecting, I need an
> immediate way to
> kick all students out and give them an instantaneous error
> message explaining
> that their session is being killed and unsaved changes will be
> lost. I'm not
> sure what the best way to do this is.
>
> Currently, I have this solution: I have a StudentService class as the
> interface between the servlets and the business objects. The
> StudentService
> contains "rough-grained" methods that get stuff in and out of the
> database.
> Before any of these database access methods get executed, I check
> to see if
> there is an administrative lock.
>
> But this doesn't seem quite secure enough. What if the adminstrator should
> login after the student has done the adminlock check but before they have
> written to the database? I guess I could use synchronized
> objects, but that
> might be overkill as my applications are pretty small and simple.
> If there was
> some way for the administrator just to kick all the students out
> the moment
> she logged in (maybe by throwing an event), that would be ideal.
> Is there some
> way to do this?
>
> thanks,
>
> Heather Buch
>
>
>
> Heather Buch
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org
>


---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org