Forums

Home » Liferay Portal » English » 3. Development

Combination View Flat View Tree View
Threads [ Previous | Next ]
toggle
emad darvishi
How to disable create session after logout ?
June 1, 2013 10:44 PM
Answer

emad darvishi

Rank: New Member

Posts: 19

Join Date: June 1, 2013

Recent Posts

How to disable create session after logout ?
emad darvishi
RE: How to disable create session after logout ?
June 2, 2013 8:32 AM
Answer

emad darvishi

Rank: New Member

Posts: 19

Join Date: June 1, 2013

Recent Posts

no body help me ?
Bart Simpson
RE: How to disable create session after logout ?
June 2, 2013 10:26 PM
Answer

Bart Simpson

Rank: Liferay Master

Posts: 524

Join Date: August 29, 2011

Recent Posts

Your question isn't clear enough? How will the server know anything about the client if you disable the session creation?
emad darvishi
RE: How to disable create session after logout ?
June 3, 2013 1:38 AM
Answer

emad darvishi

Rank: New Member

Posts: 19

Join Date: June 1, 2013

Recent Posts

Bart Simpson:
Your question isn't clear enough? How will the server know anything about the client if you disable the session creation?


thanks for your answer .

if visitor loged in portal , i wrote below code in portal-ext.properties to create only one session for this visitor :
1
2session.enable.phishing.protection=false


i want to disable create session after logout and session destroy only when time out.
Vilmos Papp
RE: How to disable create session after logout ?
June 3, 2013 1:46 AM
Answer

Vilmos Papp

LIFERAY STAFF

Rank: Expert

Posts: 472

Join Date: October 21, 2010

Recent Posts

Why would you like to do that?

The property you set means that the portal won't create a new session for the user (there's already a session for the guest user) but use the existing one.

What is your concept?
emad darvishi
RE: How to disable create session after logout ?
June 3, 2013 1:54 AM
Answer

emad darvishi

Rank: New Member

Posts: 19

Join Date: June 1, 2013

Recent Posts

i want counter the number of portal visitor by sessions .
Vilmos Papp
RE: How to disable create session after logout ?
June 3, 2013 2:04 AM
Answer

Vilmos Papp

LIFERAY STAFF

Rank: Expert

Posts: 472

Join Date: October 21, 2010

Recent Posts

Have you checked how live users statistics work?

I think if you take a look at it, perhaps you will have some idea how to achieve what you want. At least when you enable it you will see the statistics in control panel.
emad darvishi
RE: How to disable create session after logout ?
June 3, 2013 2:20 AM
Answer

emad darvishi

Rank: New Member

Posts: 19

Join Date: June 1, 2013

Recent Posts

i want create one portlet and show statistics in this portlet and save in database.
Vilmos Papp
RE: How to disable create session after logout ?
June 3, 2013 2:23 AM
Answer

Vilmos Papp

LIFERAY STAFF

Rank: Expert

Posts: 472

Join Date: October 21, 2010

Recent Posts

And the statistics would based on user login counts? If so, than I would create a hook for LoginPostAction and register the login into DB there. Since then you could build your portlet on the DB data to analyze/display it.
emad darvishi
RE: How to disable create session after logout ?
June 3, 2013 2:47 AM
Answer

emad darvishi

Rank: New Member

Posts: 19

Join Date: June 1, 2013

Recent Posts

no . this portlet counts any portal viewers(users and guests) . i used "servlet.service.events.pre" and manage session .i want disable create session after logout . do i have to override LogoutAction ?
Vilmos Papp
RE: How to disable create session after logout ?
June 3, 2013 3:42 AM
Answer

Vilmos Papp

LIFERAY STAFF

Rank: Expert

Posts: 472

Join Date: October 21, 2010

Recent Posts

I still don't get it why you want to disable session creation. As if you cannot create sessions, then your site will be unaccessible since then.

Do you really want to do this?
Vilmos Papp
RE: How to disable create session after logout ?
June 3, 2013 5:54 AM
Answer

Vilmos Papp

LIFERAY STAFF

Rank: Expert

Posts: 472

Join Date: October 21, 2010

Recent Posts

If you do that I think you will open a quite big security hole in your system. If you don't invalidate the session on logout, anybody who can access the computer where the admin user logged out a few minutes ago, can navigate back to the site, as the session will be valid, the user will have the admin's credentials, so he will be able to do anything in the portal.

I understand that you want to create a visitor counter portlet, but I think this is not the right approach to make it.
emad darvishi
RE: How to disable create session after logout ?
June 3, 2013 6:08 AM
Answer

emad darvishi

Rank: New Member

Posts: 19

Join Date: June 1, 2013

Recent Posts

i changed my session-timeout to 3 min .Does the security problem ? What is your suggest?
Vilmos Papp
RE: How to disable create session after logout ?
June 3, 2013 6:12 AM
Answer

Vilmos Papp

LIFERAY STAFF

Rank: Expert

Posts: 472

Join Date: October 21, 2010

Recent Posts

In my opinion it's simply not a good solution, but I you want to override it anyway, you can create a hook to modify the struts path for LogoutAction implementation to your custom one.
1<action path="/portal/logout" type="com.liferay.portal.action.LogoutAction" />
emad darvishi
RE: How to disable create session after logout ?
June 3, 2013 6:18 AM
Answer

emad darvishi

Rank: New Member

Posts: 19

Join Date: June 1, 2013

Recent Posts

thanks .

What is your suggest for this problem whereas not less security ?
Vilmos Papp
RE: How to disable create session after logout ?
June 3, 2013 6:43 AM
Answer

Vilmos Papp

LIFERAY STAFF

Rank: Expert

Posts: 472

Join Date: October 21, 2010

Recent Posts

I think the SessionID changes on logout by default (if you turn off physing protection I'm not sure so please check it), if you prevent the storing the new SessionID which is created for the guest user after logout by checking the last path or add an extra parameter to the URL with a hook like: userLoggedOut=true you can avoid to save it and have bad entries in your DB.
emad darvishi
RE: How to disable create session after logout ?
June 3, 2013 8:38 AM
Answer

emad darvishi

Rank: New Member

Posts: 19

Join Date: June 1, 2013

Recent Posts

Vilmos .
please see below link . what is my problem ?

http://www.liferay.com/community/forums/-/message_boards/message/25305942

i added portal-imp-6.1.0.jar to eclipse java build path .
Vilmos Papp
RE: How to disable create session after logout ?
June 3, 2013 2:07 PM
Answer

Vilmos Papp

LIFERAY STAFF

Rank: Expert

Posts: 472

Join Date: October 21, 2010

Recent Posts

Please keep in mind to DO NOT ADD portal-impl.jar into your plugins EVER. It will mess up the class loading. If you want to avoid compile errors in eclipse, simply import the portal source and add that project to your plugin under the Build Path configuration.