Home/ Questions/Q 6329113
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-24T17:35:30+00:00

I want to redirect users to the login page when a session timeout occurs.

  • 0

I want to redirect users to the login page when a session timeout occurs. This works out-of-the-box with spring security, but only on non-ajax calls.

On an ajax-call you have to react on the session timeout by yourself. Therefore I have created
my own filter(filter implemented like in this question) who checks if a session is timed out. The filter is registered via custom-filter tag in spring security config.

<http use-expressions="true">
    <custom-filter ref="customTimeoutHandler" after="LAST"/>
</http>

The problem is, that the session timeout is not recognized by the filter. If I check for request.isRequestedSessionIdValid() it returns true even if the session is timed out. When I enter a new secured URL manually, the standard spring security filter recognizes the timeout correctly and does a redirect to the login page.

What could be wrong here? How recognizes spring security the session timeout?

UPDATE

It seems, that the session management filter of spring security replaces the timed-out session with a new anonymous one. Therefore everytime I check for session timeout it returns true, because the new anonymous session is, of course, not timed-out.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This solution works like a charm for me.

    The basic concept is to point to a servlet instead of the login page. The servlet then determines if the request was a ajax request and if that is true, it returns the redirect to the login page as xml fragment. The browser can interpret that fragment and redirects to the login page.

    • 0