0

Proper logoff procedure?

asked 2009-08-20 06:21:23 +0800

wes gravatar image wes
33 1

I am having a terrible problem with my domain objects persisting after the user logs out which is
causing a nasty memory leak. The ZK classes seem to become eligible for garbage colletion on cue,
but my domain objects persist no matter what I do. I do have a static API class that calls some
methods, but I make sure to set the objects to null at the end of the method to no avail.

So I was wondering if I am supposed to call some ZK class to properly clean up a session. Here's
my logoff code:

    public static void logOff() {
    	
    	Sessions.getCurrent().invalidate();
    	Executions.sendRedirect("/Login.zul");
    	    	  
    }

That seems too simple so I must be missing something.

(Be kind; I'm primarily a researcher, not a developer!)

delete flag offensive retag edit

7 Replies

Sort by ยป oldest newest

answered 2009-08-20 08:42:50 +0800

iantsai gravatar image iantsai
2755 1

updated 2009-08-20 08:44:32 +0800

the Sessions.getCurrent().invalidate(); will only invalidate ZK's session but not HttpSession,
so if you want to clean whole things that user has(including user's server side ZK Object) you should use:

  public static void logOff() {
    	Executions.sendRedirect("/logout.jsp");
    }

and at your logout.jsp, you should kill the user's HttpSession, then every thing should be cleaned.
Be careful if you have any static object pool or back-end threads which are still alive, they won't be GCed in any case.

link publish delete flag offensive edit

answered 2009-08-20 11:41:27 +0800

Rico gravatar image Rico
175 1 1 2

Is that really true? At least in my apps, the session object stays intact even if I do a sendRedirect().

I usually do

Sessions.getCurrent().clear();


...before doing the sendRedirect();

/Rico

link publish delete flag offensive edit

answered 2009-08-20 12:51:20 +0800

iantsai gravatar image iantsai
2755 1

I think that's not enough, you need to kill HttpSession in your JSP.

Inside your logout.jsp, you should do:

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<link rel="stylesheet" type="text/css" href="css/listDiscussion.css" />
<title>List Discussion</title>
</head>
<body>
<% session.invalidate(); %>
<h1>You have already log out.</h1>
</body>
</html>

If you have done this and still get in trouble with memory leak, you need to check any static resources and manually created threads in your code.
And, if you suspect that ZK might created threads you don't know, use these piece of code in your zk.xml:

<system-config>
  <disable-event-thread/>
</system-config>

link publish delete flag offensive edit

answered 2009-08-20 13:16:35 +0800

vineetrika gravatar image vineetrika
66

or can I do the following ?

            Sessions.getCurrent().invalidate();
            ((HttpSession) Sessions.getCurrent().getNativeSession()).invalidate();

Rico, the clear method is not found in the Session object returned by Sessions.getCurrent()

Thanks
Neetu

link publish delete flag offensive edit

answered 2009-08-20 14:17:08 +0800

Rico gravatar image Rico
175 1 1 2

My bad, I was reading to fast...

But what is the difference between two ways provided by wes and iantsay:

- first invalidating the session and then do sendRedirect()

- first do the sendRedirect() and then in the page You arrive at invalidate the session?

Regards,
Rico

link publish delete flag offensive edit

answered 2009-08-20 16:14:42 +0800

wes gravatar image wes
33 1

You said that I need to "kill the user's HttpSession" in my logout page. A couple quick questions on that:

1. Are you referring to the ZK session or the session created by my webapp contianer? (I'm using Tomcat)
2. How do I go about killing that session?

Thanks!

link publish delete flag offensive edit

answered 2009-08-21 18:36:46 +0800

terrytornado gravatar image terrytornado flag of Germany
9393 3 7 16
http://www.oxitec.de/

updated 2009-08-21 19:06:33 +0800

	/** Returns the native session, or null if not available.
	 * The returned object depends on the type of clients.
	 * If HTTP, the object is an instance of javax.servlet.http.HttpSession.
	 * If portlet, the object is an instance of javax.portlet.PortletSession.
	 */

         Sessions.getCurrent().getNativeSession();

/* ++++++ Kills the Http session ++++++ */
// HttpSession s = (HttpSession) Sessions.getCurrent().getNativeSession();
// s.invalidate();

/* ++++++ Kills the zk session +++++ */
// Sessions.getCurrent().invalidate();


I'm using the spring framework. So this it's mine logout code:

// Spring action-url for the logout stuff
Executions.sendRedirect("/j_spring_logout");

link publish delete flag offensive edit
Your reply
Please start posting your answer anonymously - your answer will be saved within the current session and published after you log in or create a new account. Please try to give a substantial answer, for discussions, please use comments and please do remember to vote (after you log in)!

[hide preview]

Question tools

Follow

RSS

Stats

Asked: 2009-08-20 06:21:23 +0800

Seen: 1,040 times

Last updated: Aug 21 '09

Support Options
  • Email Support
  • Training
  • Consulting
  • Outsourcing
Learn More