Logout

Status
Released on (mm/dd/yyyy) : 01/20/2012

Objective of session logout process
Session logout have to objective to cancel conversation established between the browser and the web server. We means here, by conversation, several browser request and response that has been linked between them.

Steps of the session logout process
Logout is composed by 2 steps:
 * 1) Invalidate user session (indicate to web server that the session is not used anymore).
 * 2) Cancel cookie send by the web server to track user session (and also all cookies sent by web application, this, in order to have a global clean state).

Code sample of the session logout process
package org.owasp.javaproject.logout;

import java.io.IOException; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.Cookie; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession;

/** * Code sample showing how to perform a complete logout */ @SuppressWarnings("serial") @WebServlet("/Logout") public class LogoutCodeSample extends HttpServlet {

/**	 * {@inheritDoc} * 	 * @see javax.servlet.http.HttpServlet#doPost(javax.servlet.http.HttpServletRequest,	 *     javax.servlet.http.HttpServletResponse) */	@Override protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { doGet(request, response); }

/**	 * {@inheritDoc} * 	 * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse	 *     response) */	@Override protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { /*		 * First step : Invalidate user session */		HttpSession session = request.getSession(false); if (session != null) { session.invalidate; }

/*		 * Second step : Invalidate all cookies by, for each cookie received, * overwriting value and instructing browser to deletes it		 */ Cookie[] cookies = request.getCookies; if (cookies != null && cookies.length > 0) { for (Cookie cookie : cookies) { cookie.setValue("-"); cookie.setMaxAge(0); response.addCookie(cookie); }		}

}

}