How can I have list of all users logged in my web application

Question

I use spring-mvc and each use who logged in my web app i create a session variable user which is a object containing his id , name and some others info.

session.setAttribute("user", user);

What I want is to have a list of all users who are logged in my program.

i want this list to check simultaneous log in because is must be just one access by account.

ps : don't tell me to use spring-security because i want to work just with MVC Interceptor and preHandle()

Answer 1

1) use below code to auto-wire ServletContext object in spring MVC

@Autowired
ServletContext context; 

2) You need to collect all logged in users Set in the context.

...
    public void login(User user) {
        logins.add(user);
    }
...    
    public void logout(User user) {
        logins.remove(user);
    }

If you're storing the logged-in users in the session already

public void sessionDestroyed(HttpSessionEvent event) {
    User user = (User) event.getSession().getAttribute("user");
    if (user != null) {
        Set<User> logins = (Set<User>) event.getSession().getServletContext().getAttribute("logins");
        logins.remove(user);
    }
}

Answer 2

You can use the implementation of HttpSessionListener and ServletContextListener. HttpSessionListener gets invoked whenever a Session is created or destroyed ,Where as ServletContextListener is invoked when Context is created or destroyed.

EDIT: The HttpSessionBindingListener can be used on the class whose instances may be stored in the session, such as in your case User.

When an instance of this User get set as a session attribute by HttpSession.setAttribute(), then the valueBound() will be invoked. When it get removed by either HttpSession.removeAttribute(), or an invalidate of the session, or get replaced by another HttpSession.setAttribute(), then the valueUnbound() will be invoked.

Example :

public class User implements HttpSessionBindingListener {

@Override
public void valueBound(HttpSessionBindingEvent event) {
    addLoginUser(event);
}

@Override
public void valueUnbound(HttpSessionBindingEvent event) {
    removeLoginUser(event);
}

private void removeLoginUser(HttpSessionBindingEvent event){
if (user != null) {
            ServletContext context = event.getSession().getServletContext();
            Set<User> logins = context.getAttribute("loginUsers");
            logins.remove(this);
    }
 }
   private void addLoginUser(HttpSessionBindingEvent event){

   if (user != null) {
      ServletContext context = event.getSession().getServletContext();
      Set<User> logins = context.getAttribute("loginUsers");
      logins.add(this);
   }
}

}

 //Use this listner for adding loginUsers when ServletContext is initialized.
 public class MyServletContextListener implements ServletContextListener{
   public void contextInitialized(ServletContextEvent event){
       Set<User> logins = new HashSet<User>();

       //add Initial login to ServletContext
       event.getServletContext().setAttribute("loginUsers", logins);
   }

 public void contextDestroyed(ServletContextEvent event){}

 }

Add the following configuration in your web.xml file.

<listener>
    <listener-class>
        package.name.MySessionAttributeListener
    </listener-class>
</listener>

 <listener>
    <listener-class>
        package.name.MyServletContextListener
    </listener-class>
</listener>

Hope this helps,Thanks.