Package net.ltgt.oidc.servlet

Interface LoggedOutSessionStore

All Known Implementing Classes:
InMemoryLoggedOutSessionStore
public interface LoggedOutSessionStore
Tracks SessionID values of sessions logged out with the OpenID Connect Back-Channel Logout protocol through the BackchannelLogoutServlet.

Those sessions will be invalidated by the UserFilter when a corresponding HttpSession is being used, and once destroyed the BackchannelLogoutSessionListener is responsible for notifying this store so the SessionID can be forgotten (to prevent the store growing indefinitely).

Implementations could also directly invalidate the session if possible, rather than only marking it as logged out to later be invalidated by the UserFilter. In this case, the BackchannelLogoutSessionListener might not be necessary.

See Also:

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    CONTEXT_ATTRIBUTE_NAME
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    forget(SessionID sessionID)
    Forgets about the given session ID.
    boolean
    isLoggedOut(SessionID sessionID)
    Returns whether the given session ID has been logged out.
    void
    logout(SessionID sessionID)
    Records the given session ID as having been logged out at the OpenID Provider.

  • Field Details

    • CONTEXT_ATTRIBUTE_NAME

      static final String CONTEXT_ATTRIBUTE_NAME

  • Method Details

    • logout

      void logout(SessionID sessionID)
      Records the given session ID as having been logged out at the OpenID Provider.

      Implementations could also directly invalidate the session if possible, rather than only marking it as logged out to later be invalidated by the UserFilter. In this case, the BackchannelLogoutSessionListener might not be necessary.

      See Also:

    • isLoggedOut

      boolean isLoggedOut(SessionID sessionID)
      Returns whether the given session ID has been logged out.
      See Also:

    • forget

      void forget(SessionID sessionID)
      Forgets about the given session ID.

      This method should be called when the corresponding HttpSession has been destroyed, to release memory.

      See Also: