clean up and more

src/main/java/stirling/software/SPDF/config/EndpointInterceptor.java

@@ -151,10 +151,10 @@ public class EndpointInterceptor implements HandlerInterceptor {
                 if ((userSessions >= maxUserSessions
                                 || totalSessionsNonExpired >= maxApplicationSessions)
                         && !hasUserActiveSession) {
-                    response.sendError(
+                    log.info(
-                            HttpServletResponse.SC_UNAUTHORIZED,
                             "Max sessions reached for this user. To continue on this device, please"
                                     + " close your session in another browser.");
+                    response.sendError(HttpServletResponse.SC_EXPECTATION_FAILED);
                     return false;
                 }
 
@@ -203,10 +203,10 @@ public class EndpointInterceptor implements HandlerInterceptor {
 
                 if (totalSessions >= maxApplicationSessions && !hasUserActiveSession) {
                     sessionsInterface.removeSession(finalSession);
-                    response.sendError(
+                    log.info(
-                            HttpServletResponse.SC_UNAUTHORIZED,
                             "Max sessions reached for this user. To continue on this device, please"
                                     + " close your session in another browser.");
+                    response.sendError(HttpServletResponse.SC_EXPECTATION_FAILED);
                     return false;
                 }
                 if (!hasUserActiveSession) {

src/main/java/stirling/software/SPDF/config/anonymus/session/AnonymusSessionListener.java

@@ -193,8 +193,15 @@ public class AnonymusSessionListener implements HttpSessionListener, SessionsInt
     @Override
     public void removeSession(HttpSession session) {
         AnonymusSessionInfo sessionsInfo = (AnonymusSessionInfo) sessions.get(session.getId());
-        sessionsInfo.setExpired(true);
+        if (sessionsInfo != null) {
-        session.invalidate();
+            sessionsInfo.setExpired(true);
+        }
+        try {
+            session.invalidate();
+        } catch (IllegalStateException e) {
+            log.debug("Session {} already invalidated", session.getId());
+        }
+        sessions.remove(session.getId());
         sessions.remove(session.getId());
     }
 

src/main/java/stirling/software/SPDF/config/anonymus/session/AnonymusSessionStatusController.java

@@ -1,9 +1,10 @@
 package stirling.software.SPDF.config.anonymus.session;
 
+import java.util.List;
+
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 
@@ -12,72 +13,44 @@ import jakarta.servlet.http.HttpSession;
 
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.SPDF.config.interfaces.SessionsModelInterface;
+
 @Controller
 @Slf4j
 public class AnonymusSessionStatusController {
 
     @Autowired private AnonymusSessionListener sessionRegistry;
 
-    @GetMapping("/session/status")
+    @GetMapping("/userSession")
-    public ResponseEntity<String> getSessionStatus(HttpServletRequest request) {
+    public String getUserSessions(HttpServletRequest request, Model model) {
-        HttpSession session = request.getSession(false);
-        if (session == null) {
-            // No session found
-            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("No session found");
-        }
-
-        boolean isActiveSession =
-                sessionRegistry.getAllSessions().stream()
-                        .filter(s -> s.getSessionId().equals(session.getId()))
-                        .anyMatch(s -> !s.isExpired());
-
-        long sessionCount =
-                sessionRegistry.getAllSessions().stream().filter(s -> !s.isExpired()).count();
-
-        long userSessions = sessionCount;
-        int maxUserSessions = sessionRegistry.getMaxUserSessions();
-
-        // Session invalid or expired
-        if (userSessions >= maxUserSessions && !isActiveSession) {
-            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
-                    .body("Session invalid or expired");
-        }
-        // Valid session
-        else if (session.getId() != null && isActiveSession) {
-            return ResponseEntity.ok("Valid session: " + session.getId());
-        }
-        // Fallback message with session count
-        else {
-            return ResponseEntity.ok("User has " + userSessions + " sessions");
-        }
-    }
-
-    @GetMapping("/session/expire")
-    public String expireSession(HttpServletRequest request) {
         HttpSession session = request.getSession(false);
         if (session != null) {
-            // Invalidate current session
+
-            sessionRegistry.expireFirstSession(session.getId());
+            boolean isSessionValid =
-            log.info("Session invalidated: {}", session.getId());
+                    sessionRegistry.getAllNonExpiredSessions().stream()
-            // return ResponseEntity.ok("Session invalidated");
+                            .allMatch(
-        } else {
+                                    sessionEntity ->
-            log.info("No session to invalidate");
+                                            sessionEntity.getSessionId().equals(session.getId()));
-            // return ResponseEntity.ok("No session to invalidate");
+
+            // Get all sessions for the user
+            List<SessionsModelInterface> sessionList =
+                    sessionRegistry.getAllNonExpiredSessions().stream()
+                            .filter(
+                                    sessionEntity ->
+                                            !sessionEntity.getSessionId().equals(session.getId()))
+                            .toList();
+
+            model.addAttribute("sessionList", sessionList);
+            return "userSession";
         }
         return "redirect:/";
     }
 
-    @GetMapping("/session/expire/all")
+    @GetMapping("/userSession/invalidate/{sessionId}")
-    public ResponseEntity<String> expireAllSessions() {
+    public String invalidateUserSession(
-        // Invalidate all sessions
+            HttpServletRequest request, @PathVariable String sessionId) {
-        sessionRegistry.expireAllSessions();
+        sessionRegistry.expireSession(sessionId);
-        return ResponseEntity.ok("All sessions invalidated");
+        sessionRegistry.registerSession(request.getSession(false));
-    }
+        return "redirect:/userSession";
-
-    @GetMapping("/session/expire/{username}")
-    public ResponseEntity<String> expireAllSessionsByUsername(@PathVariable String username) {
-        // Invalidate all sessions for specific user
-        sessionRegistry.expireAllSessionsByUsername(username);
-        return ResponseEntity.ok("All sessions invalidated for user: " + username);
     }
 }

src/main/java/stirling/software/SPDF/config/security/session/CustomHttpSessionListener.java

@@ -142,25 +142,25 @@ public class CustomHttpSessionListener implements HttpSessionListener, SessionsI
                         .filter(s -> !s.isExpired() && s.getPrincipalName().equals(principalName))
                         .toList()
                         .size();
-        boolean isAnonymousUserWithoutLogin = "anonymousUser".equals(principalName) && loginEnabled;
+        boolean isAnonymousUserWithLogin = "anonymousUser".equals(principalName) && loginEnabled;
         log.info(
-                "all {} allNonExpiredSessions {} {} isAnonymousUserWithoutLogin {}",
+                "all {} allNonExpiredSessions {} {} isAnonymousUserWithLogin {}",
                 all,
                 allNonExpiredSessions,
                 getMaxUserSessions(),
-                isAnonymousUserWithoutLogin);
+                isAnonymousUserWithLogin);
 
-        if (allNonExpiredSessions >= getMaxApplicationSessions() && !isAnonymousUserWithoutLogin) {
+        if (allNonExpiredSessions >= getMaxApplicationSessions() && !isAnonymousUserWithLogin) {
             log.info("Session {} Expired=TRUE", session.getId());
             sessionPersistentRegistry.expireSession(session.getId());
             sessionPersistentRegistry.removeSessionInformation(se.getSession().getId());
             // if (allNonExpiredSessions > getMaxUserSessions()) {
             //     enforceMaxSessionsForPrincipal(principalName);
             // }
-        } else if (all >= getMaxUserSessions() && !isAnonymousUserWithoutLogin) {
+        } else if (all >= getMaxUserSessions() && !isAnonymousUserWithLogin) {
             enforceMaxSessionsForPrincipal(principalName);
             log.info("Session {} Expired=TRUE", session.getId());
-        } else if (isAnonymousUserWithoutLogin) {
+        } else if (isAnonymousUserWithLogin) {
             sessionPersistentRegistry.expireSession(session.getId());
             sessionPersistentRegistry.removeSessionInformation(se.getSession().getId());
         } else {

src/main/java/stirling/software/SPDF/config/security/session/SessionStatusController.java

@@ -3,11 +3,8 @@ package stirling.software.SPDF.config.anonymus.session;
 import java.util.List;
 
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.HttpStatus;
+import org.springframework.beans.factory.annotation.Qualifier;
-import org.springframework.http.ResponseEntity;
 import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContext;
-import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.session.SessionInformation;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
@@ -29,35 +26,32 @@ import stirling.software.SPDF.config.security.session.SessionPersistentRegistry;
 @Slf4j
 public class SessionStatusController {
 
+    @Qualifier("loginEnabled")
+    private boolean loginEnabled;
+
     @Autowired private SessionPersistentRegistry sessionPersistentRegistry;
     @Autowired private SessionsInterface sessionInterface;
 
     @Autowired private CustomHttpSessionListener customHttpSessionListener;
 
-    // Returns the current session ID or 401 if no session exists
-    @GetMapping("/session")
-    public ResponseEntity<String> getSession(HttpServletRequest request) {
-        HttpSession session = request.getSession(false);
-        if (session == null) {
-            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("No session found");
-        } else {
-            return ResponseEntity.ok(session.getId());
-        }
-    }
-
     // list all sessions from authentication user, return String redirect userSession.html
     @GetMapping("/userSession")
     public String getUserSessions(
             HttpServletRequest request, Model model, Authentication authentication) {
-        if (authentication == null || !authentication.isAuthenticated()) {
+        if ((authentication == null || !authentication.isAuthenticated()) && loginEnabled) {
             return "redirect:/login";
         }
         HttpSession session = request.getSession(false);
         if (session != null) {
-            Object principal = authentication.getPrincipal();
+            String principalName = null;
-            String principalName = UserUtils.getUsernameFromPrincipal(principal);
+            if (authentication != null && authentication.isAuthenticated()) {
-            if (principalName == null) {
+                Object principal = authentication.getPrincipal();
-                return "redirect:/login";
+                principalName = UserUtils.getUsernameFromPrincipal(principal);
+                if (principalName == null) {
+                    return "redirect:/login";
+                }
+            } else {
+                principalName = "anonymousUser";
             }
 
             boolean isSessionValid =
@@ -139,81 +133,4 @@ public class SessionStatusController {
             return "redirect:/login";
         }
     }
-
-    // Checks if the session is active and valid according to user session limits
-    @GetMapping("/session/status")
-    public ResponseEntity<String> getSessionStatus(HttpServletRequest request) {
-        HttpSession session = request.getSession(false);
-        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
-
-        if (authentication != null && authentication.isAuthenticated()) {
-            Object principalTest = authentication.getPrincipal();
-            String username = UserUtils.getUsernameFromPrincipal(principalTest);
-
-            List<SessionInformation> allSessions =
-                    sessionPersistentRegistry.getAllSessions(username, false);
-
-            boolean isActivSession =
-                    sessionPersistentRegistry.getAllSessions().stream()
-                            .filter(
-                                    sessionEntity ->
-                                            session.getId().equals(sessionEntity.getSessionId()))
-                            .anyMatch(sessionEntity -> !sessionEntity.isExpired());
-
-            int userSessions = allSessions.size();
-            int maxUserSessions = sessionInterface.getMaxUserSessions();
-
-            // Check if the current session is valid or expired based on the session registry
-            if (userSessions >= maxUserSessions && !isActivSession) {
-                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
-                        .body("Session invalid or expired");
-            } else if (session.getId() != null && isActivSession) {
-                return ResponseEntity.ok("Valid session: " + session.getId());
-            } else {
-                return ResponseEntity.ok(
-                        "User: " + username + " has " + userSessions + " sessions");
-            }
-        } else {
-            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
-                    .body("Session invalid or expired");
-        }
-    }
-
-    // Invalidates the current session
-    @GetMapping("/session/expire")
-    public ResponseEntity<String> expireSession(HttpServletRequest request) {
-        HttpSession session = request.getSession(false);
-        if (session != null) {
-            sessionPersistentRegistry.expireSession(session.getId());
-            return ResponseEntity.ok("Session invalidated");
-        } else {
-            return ResponseEntity.ok("No session to invalidate");
-        }
-    }
-
-    // Invalidates all sessions
-    @GetMapping("/session/expire/all")
-    public ResponseEntity<String> expireAllSessions() {
-        log.debug("Expire all sessions");
-        sessionPersistentRegistry.expireAllSessions();
-        return ResponseEntity.ok("All sessions invalidated");
-    }
-
-    // Invalidates all sessions for a specific user, only if requested by the same user
-    @GetMapping("/session/expire/{username}")
-    public ResponseEntity<String> expireAllSessionsByUsername(@PathVariable String username) {
-        SecurityContext cxt = SecurityContextHolder.getContext();
-        Authentication auth = cxt.getAuthentication();
-        if (auth != null && auth.isAuthenticated()) {
-            Object principal = auth.getPrincipal();
-            String principalName = UserUtils.getUsernameFromPrincipal(principal);
-            if (principalName.equals(username)) {
-                sessionPersistentRegistry.expireAllSessionsByUsername(username);
-                return ResponseEntity.ok("All sessions invalidated for user: " + username);
-            } else {
-                return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Unauthorized");
-            }
-        }
-        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Unauthorized");
-    }
 }

src/main/resources/messages_de_DE.properties

@@ -287,6 +287,14 @@ database.notSupported=Diese Funktion ist für deine Datenbankverbindung nicht ve
 session.expired=Ihre Sitzung ist abgelaufen. Bitte laden Sie die Seite neu und versuchen Sie es erneut.
 session.refreshPage=Seite aktualisieren
 
+#################
+#  USER SESSION #
+#################
+userSession.title=Benutzersitzungen
+userSession.header=Benutzersitzungen
+userSession.maxUserSession=Wenn die maximale Anzahl Sitzungen für diesen Benutzer erreicht ist, können Sie hier andere Anmeldungen beenden, um auf diesem Gerät fortzufahren.
+userSession.lastRequest=Letzte Aufrufe
+
 #############
 # HOME-PAGE #
 #############

src/main/resources/messages_en_GB.properties

@@ -287,6 +287,14 @@ database.notSupported=This function is not available for your database connectio
 session.expired=Your session has expired. Please refresh the page and try again.
 session.refreshPage=Refresh Page
 
+#################
+#  USER SESSION #
+#################
+userSession.title=User Sessions
+userSession.header=User Sessions
+userSession.maxUserSession=If the maximum number of sessions for this user is reached, you can end other logins here to continue on this device.
+userSession.lastRequest=last Request
+
 #############
 # HOME-PAGE #
 #############

src/main/resources/templates/error.html

@@ -15,8 +15,7 @@
             <p class="lead" th:if="${param.status == '404'}" th:text="#{error.404.1}"></p>
             <p class="lead" th:unless="${param.status == '404'}" th:text="#{error.404.2}"></p>
             <p class="lead" th:if="${status == 417}">
-              <a th:href="@{'/userSession'}" th:text="#{session.maxUserSession}">Max sessions reached for this user. To continue on this device, please close your
+              <a th:href="@{'/userSession'}" th:text="#{userSession.maxUserSession}">Max sessions reached for this user.</a>
-                session in another browser.</a>
             </p>
             <br>
             <h2 th:text="#{error.needHelp}"></h2>

src/main/resources/templates/userSession.html

@@ -3,7 +3,7 @@
   xmlns:th="https://www.thymeleaf.org">
 
 <head>
-  <th:block th:insert="~{fragments/common :: head(title=#{session.title}, header=#{session.header})}"></th:block>
+  <th:block th:insert="~{fragments/common :: head(title=#{userSession.title}, header=#{userSession.header})}"></th:block>
 </head>
 
 <body>
@@ -16,21 +16,21 @@
           <div class="col-md-9 bg-card">
             <div class="tool-header">
               <span class="material-symbols-rounded tool-header-icon organize">key</span>
-              <span class="tool-header-text" th:text="#{session.user}">User Session</span>
+              <span class="tool-header-text" th:text="#{userSession.title}">User Session</span>
             </div>
             <div class="bg-card mt-3 mb-3">
-              <span th:text="#{session.maxUserSession}">Max sessions reached for this user. To continue on this device, please close your session in another browser.</span>
+              <span th:text="#{userSession.maxUserSession}">Max sessions reached for this user.</span>
-              <table class="table table-striped table-hover mb-0">
+              <table th:unless="${#lists.isEmpty(sessionList)}" class="table table-striped table-hover mb-0">
                 <thead>
                   <tr>
-                    <th scope="col" th:text="#{session.sessionId}">Session ID</th>
+                    <!-- <th scope="col" th:text="#{session.sessionId}">Session ID</th> -->
-                    <th scope="col" th:text="#{session.lastRequest}">last Request</th>
+                    <th scope="col" th:text="#{userSession.lastRequest}">last Request</th>
-                    <th scope="col" th:text="#{session.invalidate}">Logout</th>
+                    <th scope="col"></th>
                   </tr>
                 </thead>
                 <tbody>
                   <tr th:each="userSession : ${sessionList}">
-                    <td th:text="${userSession.getSessionId}"></td>
+                    <!-- <td th:text="${userSession.getSessionId}"></td> -->
                     <td th:text="${userSession.getLastRequest}"></td>
                     <td><a th:href="@{/userSession/invalidate/{id}(id=${userSession.getSessionId})}"
                         class="btn btn-sm btn-danger">