Logout - Revision history

Imifos: Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

2017-11-10T11:48:00Z

Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

Dominique RIGHETTO: Title revision

2012-01-20T22:25:34Z

Title revision

Dominique RIGHETTO: Page creation

2012-01-20T22:18:43Z

Page creation

New page

==Status==
Released on (mm/dd/yyyy) : 01/20/2012

==Objective of session logout process==
Session logout have to objective to cancel conversation established between the browser and the web server. We means here, by conversation, several browser request and response that has been linked between them.

==Steps of the session logout process==
Logout is composed by 2 steps:
# Invalidate user session (indicate to web server that the session is not used anymore).
# Cancel cookie send by the web server to track user session (and also all cookies sent by web application, this, in order to have a global clean state).

==Code sample of the session logout process==
<pre>
package org.owasp.javaproject.logout;

import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

/**
* Code sample showing how to perform a complete logout
*/
@SuppressWarnings("serial")
@WebServlet("/Logout")
public class LogoutCodeSample extends HttpServlet {

/**
* {@inheritDoc}
*
* @see javax.servlet.http.HttpServlet#doPost(javax.servlet.http.HttpServletRequest,
* javax.servlet.http.HttpServletResponse)
*/
@Override
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
doGet(request, response);
}

/**
* {@inheritDoc}
*
* @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse
* response)
*/
@Override
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
/*
* First step : Invalidate user session
*/
HttpSession session = request.getSession(false);
if (session != null) {
session.invalidate();
}

/*
* Second step : Invalidate all cookies by, for each cookie received,
* overwriting value and instructing browser to deletes it
*/
Cookie[] cookies = request.getCookies();
if (cookies != null && cookies.length > 0) {
for (Cookie cookie : cookies) {
cookie.setValue("-");
cookie.setMaxAge(0);
response.addCookie(cookie);
}
}

}

}
</pre>

[[Category:OWASP Java Project]]

← Older revision		Revision as of 11:48, 10 November 2017
Line 75:		Line 75:
	</pre>		</pre>

−	[[Category:~~OWASP~~ Java ~~Project~~]]	+	[[Category:Java]]

@@ Line 5: / Line 5: @@
 Session logout have to objective to cancel conversation established between the browser and the web server. We means here, by conversation, several browser request and response that has been linked between them.
-==Steps of the session logout process==
+==Steps of session logout process==
 Logout is composed by 2 steps:
 # Invalidate user session (indicate to web server that the session is not used anymore).
 # Cancel cookie send by the web server to track user session (and also all cookies sent by web application, this, in order to have a global clean state).
-==Code sample of the session logout process==
+==Code sample of session logout process==
 <pre>
 package org.owasp.javaproject.logout;