Question

I’m having a problem in identifying a session timeout page and a page navigated directly…

user will first fill a form and submits it, based on the search he will land on information page. for some reason if he try to type the url of information page instead of coming through search page how can i restrict him?
i tried using an indicator varaible in session, but that is getting in conflict with session timeout…. how do i differentiate if it is session timeout or direct navigation?
could someone please shed some light on this and point me in right direction?

Answer 1

You could test for a server side session timeout as follows:

if (request.getRequestedSessionId() != null && !request.isRequestedSessionIdValid()) {
    // The session has been timed out (or a hacker supplied a fake cookie).
}

The request is here the HttpServletRequest which you can obtain in the JSF context from the ExternalContext#getRequest() or, actually better, inside a Filter by just downcasting the ServletRequest argument.

As a completely different alternative, you could also introduce a timed ajax poll as a “heartbeat” so that the session never expires as long as the user has the page open in the browser.