How to invalidate a session based on the session id

You have to write your own support for this.

It used to be in the API, but was deprecated as a security hole.

The best way to do it is implement a session listener (javax.servlet.http.HttpSessionListener) which notifies you when sessions are created/destroyed.

You can then keep a map of sessions in your own code, indexed by session Id, and access any/all of them to invalidate as you choose.

evnafetsa at 2007-7-9 6:25:07 >