spring security. Principals Session Inactive User Exception?

Question

Spring

Greetings dear forum users.

Please tell me, here I am getting all active users at the moment

import org.springframework.security.core.userdetails.User;

@Service
public class ActiveUserService {

    @Autowired
    SessionRegistry sessionRegistry;


    public List<String > getAllActiveUser(){


        List<Object> principals = sessionRegistry.getAllPrincipals();
        User[] users = (User[]) principals.toArray(new User[0]);

        return Arrays.stream(users).filter(user -> !sessionRegistry.getAllSessions(user, false)
                .isEmpty()).map(User::getUsername).collect(Collectors.toList());

    }

}

but, if the user left the session, that is, left, then the system still shows him as active.

How to make it so that when you exit, the system stops showing it as active?

https://github.com/romanych2021/TestSession

Answer 1

In order to solve this problem, I needed to create only one class.

package com.testsession.service;

import org.springframework.security.web.session.HttpSessionEventPublisher;
import org.springframework.web.WebApplicationInitializer;

import javax.servlet.ServletContext;

public class MyWebAppInitializer implements WebApplicationInitializer {

    @Override
    public void onStartup(ServletContext container) {
        container.addListener(new HttpSessionEventPublisher());
    }
}

Answer 2

Spring has a default session timeout of 30 minutes.
My hypothesis is that you just didn't wait 30 minutes.
The best way to make sure the user is logged out is to make a "logout" button that clears the session data.