How do you log out all logged in users in spring-security?
First define HttpSessionEventPublisher in web.xml
<listener> <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class></listener>Then define <session-management> in your spring security.xml file.
Now, use SessionRegistry in your controller method to invalidate all sessions. Below code retrieves all active sessions.
List<SessionInformation> activeSessions = new ArrayList<SessionInformation>(); for (Object principal : sessionRegistry.getAllPrincipals()) { for (SessionInformation session : sessionRegistry.getAllSessions(principal, false)) { activeSessions.add(session); } }On Each active session, you can call expireNow() method to expire or invalidate them.
Ketan gives you the answer that you are looking for, if you change the second for block and use session.expireNow(); instead activeSessions.add(session); you will end up with all active sessions expired.