HTTP Logout Event Trapping Mechanism for Session Synchronization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity protection solutions lack a generic and extensible mechanism to trap HTTP logout events across various applications and environments, as they are often specific to application servers or web servers, and fail to synchronize sessions effectively.
Innovation Solution
A method that consolidates all criteria for detecting HTTP logout events through a pluggable logout handler, allowing configuration and extension, and provides a public API for executing tasks, supporting multiple application servers and portal servers, and enabling session synchronization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a vendor uses a specific trapping mechanism for logout events, then it can trap logout events for that specific application server or web server, but it cannot trap logout events in different environments or J2EE/web containers
Solution Approach 1:
The patent implements a universal logout event trapping mechanism that works across multiple application servers and web containers by defining a standardized interface and implementation that can be deployed in different J2EE and web environments. The system uses standard HTTP protocols and session management mechanisms that are universally supported across different servers.
Solution Approach 2:
The patent segments the logout event trapping functionality into independent, configurable components that can be selectively activated based on the specific environment. The system divides the trapping mechanism into separate handlers for different event types (HTTP session expiration, explicit logout URLs, form-based logouts) that can be independently configured and combined.
2Adaptability or versatility
If a framework provides a generic solution to trap logout events, then it can work with multiple applications, but it cannot handle the innumerable ways applications can notify logout due to HTTP protocol flexibility
Solution Approach 1:
The patent implements a dynamic configuration system where the trapping mechanism can be adapted at runtime based on the specific application's logout notification methods. The system allows administrators to configure multiple trapping criteria and selectively enable/disable different trapping methods based on the application being accessed, making the generic solution flexible enough to handle diverse logout notification approaches.
Solution Approach 2:
The patent introduces an intermediary layer between the HTTP protocol and the logout event trapping logic. This intermediary consists of configurable filters and interceptors that can detect various logout notification methods (URL parameters, form submissions, session expiration) and translate them into a standardized internal event format, simplifying the complexity of handling numerous HTTP protocol variations.
3Measurement precision
If vendors use one or more techniques to trap logout events, then they can detect specific logout events, but they lack a mechanism to synchronize HTTP sessions of application, web, and portal servers
Solution Approach 1:
The patent merges the logout event trapping and session synchronization functionalities into a unified mechanism. When a logout event is detected through any trapping method, the system automatically initiates session invalidation across multiple servers (application server, web server, portal server) by coordinating through standard session management protocols, ensuring consistent logout state across the entire distributed system.
Solution Approach 2:
The patent implements a feedback mechanism where the trapping system monitors logout events and provides feedback to the session management system, which then coordinates session invalidation across multiple servers. The system uses standardized session identifiers and validation tokens that circulate between servers, providing continuous feedback about session state and ensuring all servers are synchronized when a logout occurs.
Data Source
AI summary
A method of trapping a logout event includes receiving an HTTP request, checking if a URI of the HTTP request matches an entry in a first map, looking for an entry in a second map, checking for a logout parameter in a list of request query parameters, checking for a logout parameter in a header of the HTTP request, checking for a logout parameter in a body of the HTTP request, and triggering a logout event when the first of the entries or parameters if found. The method can be extended to call a logout handler and can be used in a wide range of web-based computing environments and in particular with policy/web/j2ee agents.