Security patterns: Forcing disconnection

[DarioCrivelli]

Lightstreaemer Server 3.6 release is now available.
What follows is a sample code for forcing session termination from the Metadata Adapter, made possible by the new "destroy session" request.
The sample can substitute the JMX based one shown earlier in this thread and represents a new implementation of Option 1 introduced above.

So, we show a code snippet that, added to the Metadata Adapter code, listens to the notifications for session initiation and termination and causes each session to be closed after it has lived longer than five minutes.
Upon forced session closure, the Web Client Library will enter "DISCONNECTED" state and won't try to recover the session; it will just notify application code through the "onServerError" event handler, with proper error codes.

<br /> import java.io.BufferedReader;<br /> import java.io.DataOutputStream;<br /> import java.io.IOException;<br /> import java.io.InputStream;<br /> import java.io.InputStreamReader;<br /> <br /> import java.net.HttpURLConnection;<br /> import java.net.URL;<br /> <br /> import java.util.HashSet;<br /> import java.util.Map;<br /> import java.util.Set;<br /> import java.util.Timer;<br /> import java.util.TimerTask;<br /> <br /> import com.lightstreamer.interfaces.metadata.CreditsExcep tion;<br /> import com.lightstreamer.interfaces.metadata.Notification Exception;<br /> <br /> .................<br /> <br /> private static final String host = "localhost";<br /> private static final int port = 80;<br /> // we cast the local port number; the ports used by the current instance<br /> // of Lightstreamer Server cannot be inspected in a simple way;<br /> // the name of the configured <http_server> or <https_server> block<br /> // related with the port on which the requests for the current session<br /> // have been received is available as the "LOCAL_SERVER" element in the<br /> // clientContext Map in notifyNewSession<br /> <br /> private final Set currSessions = new HashSet();<br /> private final Timer timer = new Timer();<br /> private final long expiryTime = 5 * 60 * 1000;<br /> <br /> public void notifyNewSession(String user, final String session, Map clientContext)<br /> throws CreditsException, NotificationException {<br /> <br /> synchronized (currSessions) {<br /> currSessions.add(session);<br /> }<br /> timer.schedule(new TimerTask() {<br /> public void run() {<br /> synchronized (currSessions) {<br /> if (! currSessions.contains(session)) {<br /> return;<br /> }<br /> }<br /> try {<br /> killSession(session);<br /> // this also causes notifySessionClose to be called<br /> } catch (IOException e) {<br /> // TODO<br /> }<br /> }<br /> }, expiryTime);<br /> }<br /> <br /> public void notifySessionClose(String session) throws NotificationException {<br /> synchronized (currSessions) {<br /> currSessions.remove(session);<br /> }<br /> }<br /> <br /> private void killSession(String session) throws IOException {<br /> URL url = new URL("http", host, port, "/lightstreamer/control.txt");<br /> <br /> HttpURLConnection connection = (HttpURLConnection) url.openConnection();<br /> connection.setRequestMethod("POST");<br /> connection.setUseCaches(false);<br /> connection.setDoOutput(true);<br /> connection.setDoInput(true);<br /> connection.setAllowUserInteraction(false);<br /> <br /> DataOutputStream requestStream = new DataOutputStream(connection.getOutputStream());<br /> requestStream.writeBytes("LS_op=destroy&LS_session =" + session);<br /> requestStream.flush();<br /> requestStream.close();<br /> <br /> InputStream answerStream = connection.getInputStream();<br /> BufferedReader answer = new BufferedReader(new InputStreamReader(answerStream));<br /> String outcome = answer.readLine();<br /> if (outcome != null && outcome.equals("OK")) {<br /> // done<br /> } else if (outcome != null && outcome.equals("SYNC ERROR")) {<br /> // the session was not found<br /> // TODO<br /> } else {<br /> // an unexpected condition occurred<br /> // TODO<br /> }<br /> connection.disconnect();<br /> }<br /> <br /> .........<br /> <br />

Note that the above code can only be used in Lightstreamer "Presto" or "Vivace" edition, in which the text interface is available.
In "Allegro" or "Moderato" edition, we need to resort to the html or javascript interface; the following code snippet exploits the javascript case; the request syntax is the same, but for control.js in place of control.txt.

<br /> import java.io.DataOutputStream;<br /> import java.io.IOException;<br /> import java.io.InputStream;<br /> <br /> import java.net.HttpURLConnection;<br /> import java.net.URL;<br /> <br /> import java.util.HashSet;<br /> import java.util.Map;<br /> import java.util.Set;<br /> import java.util.Timer;<br /> import java.util.TimerTask;<br /> <br /> import com.lightstreamer.interfaces.metadata.CreditsExcep tion;<br /> import com.lightstreamer.interfaces.metadata.Notification Exception;<br /> <br /> .................<br /> <br /> private static final String host = "localhost";<br /> private static final int port = 80;<br /> // we cast the local port number; the ports used by the current instance<br /> // of Lightstreamer Server cannot be inspected in a simple way;<br /> // the name of the configured <http_server> or <https_server> block<br /> // related with the port on which the requests for the current session<br /> // have been received is available as the "LOCAL_SERVER" element in the<br /> // clientContext Map in notifyNewSession<br /> <br /> private final Set currSessions = new HashSet();<br /> private final Timer timer = new Timer();<br /> private final long expiryTime = 5 * 60 * 1000;<br /> <br /> public void notifyNewSession(String user, final String session, Map clientContext)<br /> throws CreditsException, NotificationException {<br /> <br /> synchronized (currSessions) {<br /> currSessions.add(session);<br /> }<br /> timer.schedule(new TimerTask() {<br /> public void run() {<br /> synchronized (currSessions) {<br /> if (! currSessions.contains(session)) {<br /> return;<br /> }<br /> }<br /> try {<br /> killSession(session);<br /> // this also causes notifySessionClose to be called<br /> } catch (IOException e) {<br /> // TODO<br /> }<br /> }<br /> }, expiryTime);<br /> }<br /> <br /> public void notifySessionClose(String session) throws NotificationException {<br /> synchronized (currSessions) {<br /> currSessions.remove(session);<br /> }<br /> }<br /> <br /> private void killSession(String session) throws IOException {<br /> URL url = new URL("http", host, port, "/lightstreamer/control.js");<br /> <br /> HttpURLConnection connection = (HttpURLConnection) url.openConnection();<br /> connection.setRequestMethod("POST");<br /> connection.setUseCaches(false);<br /> connection.setDoOutput(true);<br /> connection.setDoInput(true);<br /> connection.setAllowUserInteraction(false);<br /> <br /> DataOutputStream requestStream = new DataOutputStream(connection.getOutputStream());<br /> requestStream.writeBytes("LS_op=destroy&LS_session =" + session);<br /> requestStream.flush();<br /> requestStream.close();<br /> <br /> InputStream answerStream = connection.getInputStream();<br /> /*<br /> * TODO interpretation of the response<br /> */<br /> connection.disconnect();<br /> }<br /> <br /> .........<br /> <br />


Note that the response is in javascript and it is more complicated to analyze it.
In case the operation is successful we should expect:
<br /> /*<br /> window.LS_lastError = {};<br /> window.LS_lastError[1] = null;<br /> <br /> */<br />
On the other hand, if the session was not found we should expect:
<br /> /*<br /> window.LS_lastError = {};<br /> window.LS_lastError[1] = "sync error";<br /> <br /> */<br />
Any other response means that an unexpected condition has occurred.