Question

After session timeout occurs, sometimes after logging in again I am presented with a resource(json file) that is normally only requested by an ajax call.

I presume this is because the ajax url is secured. The session times out and then the next request is this ajax call, this is then set as the url to hit once successfully logged in again.

I’m looking to maybe say that on ajax calls that are made after a timeout should not be set as the request to eb executed after successful login again. Is there away to do this without writing a security filter? Maybe a spring configuration option.

Answer 1

The simplest option is to set a default location to go to after logging in, using the default-target-url namespace option to form-login, and also set always-use-default-target to true, so that even if another URL is requested, the user will be sent to that location.

Alternatively, inject your own AuthenticationSuccessHandler to inject the behaviour you want.