summaryrefslogtreecommitdiffstats
path: root/documentation/articles/HandlingLogout.asciidoc
blob: 0ce052b71bf981ac76af2f92c0b5bfd5f4b272c9 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
---
title: Handling Logout
order: 21
layout: page
---

[[handling-logout]]
= Handling logout
What should happen the user wants to log out from a Vaadin application
depends on how the user is stored when the user logged in.

If the user information is stored in the `VaadinSession`, that session
should be closed using its `close()` method. If the information on the
other hand is stored in the `HttpSession` or `PortletSession`, then that
session should be invalidated using the `invalidate()` method in Vaadin's
`WrappedSession` that represents either underlying session type.

Aside from removing the user's information, the user should also be
redirected to a logout page to avoid keeping the UI open in the browser
after all server-side information about is has been removed.

[source,java]
....
private void logout() {
    // Close the VaadinServiceSession
    getUI().getSession().close();

    // Invalidate underlying session instead if login info is stored there
    // VaadinService.getCurrentRequest().getWrappedSession().invalidate();

    // Redirect to avoid keeping the removed UI open in the browser
    getUI().getPage().setLocation(getLogoutPageLocation());
}
....