Spring ModelAttribute show old value after logout

Question

I am developing an application using Spring. I have a trouble about login and logout. I logged in application using a login credentials(e.g. userName:john, pass: doe) and go to Admin page and than I logged out from application. But this time I used different login credentials(e.g. userName: jack, pass: white) for login. When I go to Admin page and debug my application @ModelAttribute(value = "myUser") User loggedInUser at AdminController shows old user value. I couldn't understand why this occurs. Anyone can help?

My source codes are below:

@Controller
@RequestMapping("/LoginController")
@SessionAttributes({"myUser"})
public class LoginController 
{
    private static String LOGIN_URL         = "login/login_";
    private static String INDEX_URL         = "main/index";

    @Autowired
    private IUserService userService    = null;

    @RequestMapping("/login")
    public ModelAndView login(@RequestParam(value="userName", required=false) String argUserName, @RequestParam(value="password", required=false) String argPassword, HttpServletRequest req)
    {

        ModelAndView modelAndView = new ModelAndView();

        // Assume argUserName and argPassword not null
        User loginUser = this.userService.getUser(argUserName, argPassword);

        HttpSession ses = req.getSession();

        // Assume loginUser not null
        ses.setAttribute("myUser", loginUser);

        modelAndView.setViewName(LoginController.INDEX_URL);

        return modelAndView;
    }

    @RequestMapping("/logout")
    public String logout(HttpServletRequest argReq, HttpServletResponse argResp) throws ServletException, IOException
    {
        HttpSession session = argReq.getSession(false);

        Enumeration<?> attributeNames = session.getAttributeNames();
        while(attributeNames.hasMoreElements())
        {
            String attrName = (String)attributeNames.nextElement();

            if(session.getAttribute(attrName) != null)
            {
                session.setAttribute(attrName,null);
                //session.removeAttribute(attrName);
                attributeNames = session.getAttributeNames();
            }
        }
        // close session
        session.invalidate();

        return LoginController.LOGIN_URL;
    }
}

AdminController

@Controller
@RequestMapping("/AdminController")
@SessionAttributes({"myUser"})
public class AdminController 
{
    private static String SETTINGS_PAGE = "settings/index";

    @RequestMapping("/index")
    public ModelAndView index(@ModelAttribute(value = "myUser") User loggedInUser, HttpSession ses)
    {
        ModelAndView modelAndView = new ModelAndView();
        Map<String, Object> map = new HashMap<String, Object>();

        map.put("loggedInUserId", loggedInUser.getUserID());
        map.put("userName", loggedInUser.getUserName());

        modelAndView.addAllObjects(map);

        modelAndView.setViewName(AdminController.SETTINGS_PAGE);
        return modelAndView;
    }

}

Answer 1

Remove this annotation

@SessionAttributes({"myUser"})

Answer 2

For starters @SessionAttributes isn't designed to store data in the session between different controllers. Its intended use is only to store data for the same controller in between requests. If you want to store items in the session between requests store them in the session yourself and don't rely on @SessionAttributes. This is also mentioned in the javadoc of the annotation (although a bit cryptic maybe).

If you want to remove object cached by @SessionAttributes you cannot simply clear the session but you would have to use the SessionStatus object (which you can add as an argument) to mark the use of these objects complete.

Your logout method is way to verbose, simply calling session.invalidate() should be enough, but I guess this was one of your attempts to fix things. Also when you are on a Servlet 3.0 container simply calling request.logout() could be enough (or call it in conjunction with session.invalidate())

My final advice would be to use Spring Security instead of trying to develop your own security solution.