Question

I am using Spring Security 3.0.6 and I would like to be able to do the following:

If the user is a on a page and a session timeout occurs, the user will be taken to the log in page and on valid log in redirected back to the page the timeout occurred on.

I currently have the following in my security.xml file.

<http auto-config="true" use-expressions="true">
    <form-login
        login-page="/login" 
        default-target-url="/main" 
        always-use-default-target="false"
        authentication-failure-url="/login.html?error=true"
        authentication-success-handler-ref="authenticationSuccessHandler" />
    <remember-me/>
    <logout logout-success-url="/login" />
</http>

This is my authentication class:

public class AuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {

public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException {

    String url = "";

    HttpSession session = request.getSession(false);
    if (session != null) {
        SavedRequest savedRequest = (SavedRequest) session.getAttribute(WebAttributes.SAVED_REQUEST);
        if (savedRequest != null) {
            url = savedRequest.getRedirectUrl();
        }
    }

    System.out.println("url: "+ url);

    if (url == "") {
        response.sendRedirect(request.getContextPath()+"/main");
    } else {
        response.sendRedirect(url);
    }
}

}

I send the user back to the log in page via javascript like:

window.location.href="/login";

The url is always null in my authentication class. How can I make this work so Spring will redirect to the correct page?

Answer 1

You don’t need to write any custom code since Spring Security can do that by default. Take a look to the documentation regarding authentication-success-handler-ref here.

authentication-success-handler-ref

This can be used as an alternative to default-target-url and always-use-default-target, giving you full control over the navigation flow after a successful authentication. The value should be the name of an AuthenticationSuccessHandler bean in the application context. By default, an implementation of SavedRequestAwareAuthenticationSuccessHandler is used and injected with the default-target-url.

Reference to an AuthenticationSuccessHandler bean which should be used to handle a successful authentication request. Should not be used in combination with default-target-url (or always-use-default-target) as the implementation should always deal with navigation to the subsequent destination.