Question

I’m using Spring MVC for a personal webpage with a local Tomcat 6 server. I’m using a default Tomcat configuration(what eclipse would setup by default).

In my controllers(using one controller for each page, and creating Session beans to pass information between them) I have two methods, one for capturing a POST and one for capturing a GET Request Method. The page logic will have the user click a submit button and will use a “redirect:abc.htm” return to send them to a new page or back to the GET method.

I’m not explicitly handling cookies, but do have all the information in Session Beans and am using Spring Security to handle security/user management.

I have a spring security configuration to redirect the user back to the login page if they are not authorized. I also have an ExceptionHandler catching HttpSessionRequiredException, though this is not what is triggering when I expire the user sessions(it’s using the logic of my Spring Security configuration).

When the session is expired(I’m doing this through Tomcat manager) the user is redirected back to the login page. They are redirected after they try to do something(click a submit, or revisit any page except login.htm).

My issue is that once they get back to the initial page that their session expired at, if at the time of expiration they clicked a submit button, it is redirecting them past the initial page and handling the POST event from the submit.

Example:

1. User is logged in, and on the main page
2. User Session Expires
3. User, on the main page, click a submit button
4. User is redirected back to the login.htm page
5. User logs in and navigates back to the main page.
6. Instead of following the logic of the GET for the main page, they are treated to the POST of the main page, and I’m not sure where the POST variables are coming from.

Is there any way to trace where this error is coming from or what exactly is causing it?

Answer 1

This is done by spring-security. Spring security stores the request details in the session before redirecting the user to the login page. On successful login it will retrieve the request details from the session and redirect to that.

You can set the always-use-default-target attribute of the form-login configuration to override this behavior.