After logout main window the popup window links still working - authentication

Question

I am using struts 2 login interceptor. Code is working fine. In my application many popup windows have used.when I open my popup window and logout from my main window popup window showing login page as I coded but only for this scenario, i want that it will showing any message ( either session expired or u have already logged out) instead of login page.
Please go thru my code if any modification is required
LoginInterceptor.java
public class LoginInterceptor extends AbstractInterceptor implements
StrutsStatics{
private AdminUserSessionInfo objAdminUserSessionInfo = new AdminUserSessionInfo();
private static final long serialVersionUID = 1L;
private static final Log log = LogFactory.getLog(LoginInterceptor.class);
private static final String LOGIN_ATTEMPT = "loginAttempt";
private static final String LOGIN_OUT = "loginOut";
private static final String USER_HANDLE = "loggedInUser";
Map sessionMap = null;
public void init() {
log.info("Intializing LoginInterceptor");
}
public void destroy() {
}
public String intercept(ActionInvocation invocation) throws Exception {
final ActionContext context = invocation.getInvocationContext();
HttpServletRequest request = (HttpServletRequest) context
.get(HTTP_REQUEST);
HttpServletResponse response = (HttpServletResponse) context
.get(HTTP_RESPONSE);
response.setHeader("Cache-Control", "no-store");
response.setHeader("Pragma", "no-cache");
response.setDateHeader("Expires", 0);
HttpSession session = request.getSession(true);
Object user = session.getAttribute(USER_HANDLE);
String loginOut = request.getParameter(LOGIN_OUT);
if (user == null) {
String loginAttempt = request.getParameter(LOGIN_ATTEMPT);
System.out.println("loginAttemp---->"+loginAttempt);
/* The user is attempting to log in. */
if (!StringUtils.isBlank(loginAttempt)) {
return invocation.invoke();
}
return "login";
} else {
return invocation.invoke();
}
}
web.xml
<interceptors>
<interceptor class="org.iaf.aos.common.LoginInterceptor"
name="loginInterceptor"></interceptor>
<interceptor-stack name="loginStack">
<interceptor-ref name="loginInterceptor" />
<interceptor-ref name="defaultStack" />
</interceptor-stack>
</interceptors>
<default-interceptor-ref name="loginStack"></default-interceptor-ref>
<global-results><result name="login">aos.jsp</result></global-results>
<action name="checkUserLogin" class="org.iaf.aos.web.login.action.AdminUserAction" method="checkUserLogin">
<!-- <result name="success">index.jsp</result> -->
<interceptor-ref name="loginStack"></interceptor-ref>
<result name="success" type="chain">HomePage</result>
<result name="error">WEB-INF/jsp/admin/Error.jsp</result>
<result name="selectRole">aos1.jsp</result>
<!--<result name="selectRole">WEB-INF/jsp/admin/SelectRole.jsp</result>-->
</action>
<action name="home">
<!-- <result>index.jsp</result>-->
<interceptor-ref name="loginStack"></interceptor-ref>
<result name="success" type="chain">HomePage</result>
</action>
<action name="logOutUser" class="org.iaf.aos.web.login.action.LogOutUserAction">
<interceptor-ref name="loginStack"></interceptor-ref>
<result name="logout">WEB-INF/jsp/admin/LoggedOut.jsp
</result>
</action>
LogOutUserAction.java
public class LogOutUserAction extends ActionSupport {
private static final long serialVersionUID = 1L;
public String execute() throws Exception {
System.out.println("inside :: LogOutUserAction------");
Map session = ActionContext.getContext().getSession();
session.remove("loggedInUser");
return "logout";
}
}
logout.jsp
<td width="*" align="right" valign="top">
<s:url var="urlLogOut" action="logOutUser.action">
<s:param name="loginOut" value="%{'2'}"/>
</s:url>
<sx:a href="%{#urlLogOut}" targets="divAddEditUser">
<font color="white">Log Out</font>
</sx:a>
<!--<font color="white">Log Out</font>
--></td>
</tr>
AdminUserAction.java
ServletActionContext.getRequest().getSession().setAttribute("loggedInUser", loginId);
return "selectRole";

Answer 1

You will have to do that explicitly write that logic, It wont do by default.
In your logout action after removing the user from session, invalidate it too.
session.remove("loggedInUser");
session.invalidate();
session = null;
Then in your interceptor you check if session is valid or not, if not then you add an attribute, stating your session has either expired or you have logged out.
So your interceptor code become something like this:
HttpSession session = request.getSession(true);
if(session == null){
request.setAttribute("SessionExpired","Your session has expired or you have logged out");
}
Object user = session.getAttribute(USER_HANDLE);
Then if your jsp page when you show the login screen you check if request has "SessionExpired" attribute, if yes show that to the user.