Listening for session timeout events via SessionManager

[Garoad <eh...@gmail.com>]

The docs page on the website currently has a "TODO" for SessionManager - is
there any documentation yet on how we listen for events such as session
timeouts?  

What I'd like to do is keep track of who is logged on at any given time, so
when a session starts I'll store a record (probably just in non-persistent
memory since I don't care about retaining sessions between server restarts),
and when the session ends or expires I want to remove that record.  The
record will probably just have a user alias (username) but it may have some
other extra info too.  (If there's a simpler way of doing this I'm open to
suggestions.)  It's a bit like the "who's online" feature you often see on
web forums.
-- 
View this message in context: http://shiro-user.582556.n2.nabble.com/Listening-for-session-timeout-events-via-SessionManager-tp5998503p5998503.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Listening for session timeout events via SessionManager

[Alex Salazar <al...@alexsalazar.com>]

Hi Garoad,

Currently SessionListener support only works when using Shiro's native
session management, so you must be using that. (e.g. in a web app's
shiro.ini:  securityManager.sessionMode = native)

You can implement the org.apache.shiro.session.SessionListener
interface and plug it in to the session manager.  For example, in
shiro.ini:

mySessionListener = my.class.that.implements.SessionListener
...

securityManager.sessionManager.sessionListeners = $mySessionListener

But note that the SessionListener#onExpiration method is _not_ called
the instant a session expires.  It is called when the session is
validated, which can occur lazily or proactively at a periodic time
(e.g. once an hour).  So keep in mind that the timestamp when that
method is called is not useful - you'd want to call
session.getLastAccessTime() to find out when it was actually last
used.  The SessionListener JavaDoc is pretty good and explains this
(and more).

Does that help?

Alex Salazar
Katasoft: Professional Support and Service for Apache Shiro:
http://www.katasoft.com

On Sun, Feb 6, 2011 at 12:49 PM, Garoad <eh...@gmail.com> wrote:

>
> The docs page on the website currently has a "TODO" for SessionManager - is
> there any documentation yet on how we listen for events such as session
> timeouts?
>
> What I'd like to do is keep track of who is logged on at any given time, so
> when a session starts I'll store a record (probably just in non-persistent
> memory since I don't care about retaining sessions between server
> restarts),
> and when the session ends or expires I want to remove that record.  The
> record will probably just have a user alias (username) but it may have some
> other extra info too.  (If there's a simpler way of doing this I'm open to
> suggestions.)  It's a bit like the "who's online" feature you often see on
> web forums.
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/Listening-for-session-timeout-events-via-SessionManager-tp5998503p5998503.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>