jsf - How to properly logout other users -

in web app trying achieve functionality, admin able logout other logged in users.

what have done far:

• i created pojo store significant user information, including referrence users http session.
• this pojo implementing httpsessionbindinglistener
• during login process put instance of pojo sessionmap. via valuebound method putting static map, stores such logged-in-userinformation (on unbound-event removing again
• in seperated admin section able access httpsession of specific user , invalidate it
• the logged-out user gets informed via websocket has been logged-out

invalidating httpsession works fine , mentioned unbound method called. however, problem if in way logged out user still able ajax requests. new instance of hte viewscoped bean created , assigned client , request goes against new instance.

what expect (or achieve) sth viewexpiredexception thrown instead , redirecting user login page instead.
or missing important part in concept?

would enough set proper security-constraints in web.xml or hide conceptual problem?

(if it's important, bean not jsf bean cdi viewscoped bean.)

application running on glassfish 4.1,, mojarra 2.2.12

---

sessionbindinglistener:

@requiredargsconstructor @equalsandhashcode(of = {"user"}) public class usersessioninfo implements httpsessionbindinglistener {      @getter private static final map<usersessioninfo, usersessioninfo> sessions           = new hashmap<>(10);      @getter private final string user;     @getter private httpsession session;      @override     public void valuebound(httpsessionbindingevent event) {         usersessioninfo usi = sessions.remove(this);         if (usi != null) {             httpsession hs = usi.session;             if (hs != null) {                 hs.invalidate();             }         }         this.session = event.getsession();         sessions.put(this, this);     }      @override     public void valueunbound(httpsessionbindingevent event) {         sessions.remove(this);     }  } 

login-method

public string login() {         facescontext context = facescontext.getcurrentinstance();                 httpservletrequest request =             (httpservletrequest) context.getexternalcontext().getrequest();         try {             request.login(username, password);             context                 .getexternalcontext()                 .getsessionmap().put(username, new usersessioninfo(/* ...*/)));             // ..         }          // ....         return "/index?faces-redirect=true";     } 

admin-method logging out other user:

public void logoff(usersessioninfo usr) {     eventbus eventbus = eventbusfactory.getdefault().eventbus();             eventbus.publish(channel, new dialogmessage(/*...*/));             usr.getsession().invalidate();            } 

if session of user invalidated, requests should fail, ajax or not.

in 1 of app, have :

• security restrictions, through roles in web.xml
• session tracking httpsessionlistener , filter (the filter way detect new sessions created tomcat on login, avoid session fixation)
• the possibility "kill" session, using session.invalidate

if session recreated "in back", must because have unrestricted area being access. require auth all, rule such :

<security-constraint>     <display-name>authenticated users</display-name>     <web-resource-collection>         <web-resource-name>authenticated users</web-resource-name>         <url-pattern>/*</url-pattern>         <http-method>get</http-method>         <http-method>post</http-method>     </web-resource-collection>     <auth-constraint>         <role-name>*</role-name>     </auth-constraint>     <user-data-constraint>         <transport-guarantee>confidential</transport-guarantee>     </user-data-constraint> </security-constraint> 

in web.xml, , should ok.