Question

I use Spring Security 3 in my JSF2 webapp.

I have a security rule to provide session timeouts:

<session-management invalid-session-url="/faces/paginas/autenticacion/login.xhtml?error=1" />

So that when the session has expired and the user clicks on any link, he is redirected to the login page. In this page I check for the error param, and show a message to the user saying the session has expired.

But I have 2 problems:

(1) When I startup the app the first time (it tries to show the home page), I’m redirected to the login page saying session has expired. I think that this may be happening because the 1st time you run the app, the session is a new one, and Spring Security perhaps “thinks” he has expired (doesn’t distinguish betwen a new session and a timeout).

(2) If the session has expired for anonymous users (not yet authenticated), I’m redirected to the login page timeout too. I don’t want this behaviour for non-authenticated users, I just want to check the timeouts for authenticated users.

How can I solve both of these problems?

Thank you in advance.

Answer 1

You want to use the expired-session-url property for expired sessions, not the invalid-session-url. They are for two different things.