How to invalidate session in JSF 2.0?

Question

What is the best possible way to invalidate session within a JSF 2.0 application? I know JSF itself does not handle session. So far I could find

private void reset() {
    HttpSession session = (HttpSession) FacesContext.getCurrentInstance()
            .getExternalContext().getSession(false);
    session.invalidate();
}

1. Is this method correct? Is there a way without touching the ServletAPI?
2. Consider a scenario wherein a @SessionScoped UserBean handles the login-logout of a user. I have this method in the same bean. Now when I call the reset() method after I'm done with necessary DB updates, what will happen to my current session scoped bean? since even the bean itself is stored in HttpSession?

Solution 1

Firstly, is this method correct? Is there a way without touching the ServletAPI?

You can use ExternalContext#invalidateSession() to invalidate the session without the need to grab the Servlet API.

@ManagedBean
@SessionScoped
public class UserManager {

    private User current;

    public String logout() {
        FacesContext.getCurrentInstance().getExternalContext().invalidateSession();
        return "/home.xhtml?faces-redirect=true";
    }

    // ...

}

---

what will happen to my current session scoped bean? since even the bean itself is stored in HttpSession?

It will still be accessible in the current response, but it will not be there anymore in the next request. Thus it's important that a redirect (a new request) is fired after invalidate, otherwise you're still displaying data from the old session. A redirect can be done by adding faces-redirect=true to the outcome, as I did in the above example. Another way of sending a redirect is using ExternalContext#redirect().

public void logout() throws IOException {
    ExternalContext ec = FacesContext.getCurrentInstance().getExternalContext();
    ec.invalidateSession();
    ec.redirect(ec.getRequestContextPath() + "/home.xhtml");
}

Its use is however questionable in this context as using a navigation outcome is simpler.

Solution 2

public void logout() {
    FacesContext.getCurrentInstance().getExternalContext().invalidateSession();
}

Comments

[ptkato]

@BalusC, what's the difference between ExternalContext#invalidateSession() and HttpSession#invalidate()?

[BalusC]

@Patrick: Functionally, nothing. They both do exactly the same. ExternalContext#invalidateSession() calls under the covers HttpSession#invalidate() (see also the javadoc link in my answer). Design-technically, the ExternalContext approach is better. You should basically strive to have zero javax.servlet.* imports in any of your JSF related artifacts.

[user1156544]

What about a SSL session? Is it possible to invalidate it? Because I tried unsuccessfully via the suggested method