SAP Commerce Backoffice - Redirect to specific url or run custom code on Session timeout

[Erik3]

Hi,

I am trying to customize SAP Commerce backoffice to run some custom code for cleanup when the session times out.

I have configured the session timeout through the property: backoffice.session.timeout=30, to quickly test the timeout.

When the timeout happens, I want to run some custom code to do some cleanup. However, I cannot find a way to do this. I have tried setting an invalid session strategy and an invalid session url (seperately).

invalid-session-strategy-ref

However, neither of these get picked up on session timeout. They do get picked up on manual logout though. I have also tried registering a httpSessionListener but I am not able to manipulate the response here so I cannot clear cookies and perform redirects.

[mansurarisoy]

You can extend DefaultSessionCloseStrategy and override the following method

public void closeSessionInHttpSession(HttpSession session)

You can execute your custom code before or after calling the super method.

Actually, this strategy is where the timeout is defined for the session with the property backoffice.session.timeout via setTimeoutOnHttpSessionCreation and trySettingExtensionSpecificTimeout methods. 

In you custom code, you can get the extension name as follows and if it's equal to "backoffice" you can execute your logic

Tenant tenant = this.getCurrentTenant(httpSession);
String webApp = httpSession.getServletContext().getContextPath();
String extensionName = Utilities.getExtensionForWebroot(webApp, tenant.getTenantID());

Hope this helps,

[Erik3]

Sorry, I have already tried this but I need to clear cookies as stated in the question. This is not possible from the DefaultSessionCloseStrategy in any way I can tell.

[mansurarisoy]

Sorry, I missed the part you wanted to remove cookies. I think you can achieve what you need with filters since you have access both the request and response. However I am not sure if you can understand if the session is timed out or user is logged out. You can try to see if it works in one of the filters (e.g. backofficeRedirectFilter) to see if you can understand session timeout via debugger. If that works, I can suggest a way to add your custom filter to backofficeFilterChain