使用 Spring-Security 实现 HttpSessionLister 时出现问题

Question

I am using Spring/Hibernate and Spring-Security for my web-based application. Now I have a requirement where I need to perform some database query at sessionDestroy method of HtppSessionLister.

Inside web.xml :

<listener>
        <listener-class>com.test.TestSessionListner</listener-class>
</listener>
<session-config>
        <session-timeout>1</session-timeout>
</session-config>

With my implementation, after session timeout (of 1 min), its calling the sessionDestroyed method and fetching the required Object of TestFacade from the ApplicationContext .

Now my problem is whenever I am calling the following method using userFacade, its not able to execute the code inside the method :

Person person = testFacade.findPersonByUserId(userId);

How can I identify the root cause for this?

Answer 1

Finally got the issue....

Inside sessionDestroyed I was calling a method :

Person person = testFacade.findPersonIdByUserId(userId);

which needs some higher permissions then anonymousUser to execute the method, and at sessionDestroyed its clearing the existing user and calling sessionDestroyed method with anonymousUser permission.

So finally I have written a code, which is calling a method using Administrator writes.