Question

In my application I have an invalid-session-url and I was wondering if it’s possible to get the username in the invalid-session-url? If so please advise how to do that.

Answer 1

Yes, it is possible. You can send cookie to user’s web browser with value of his/her username when user is authenticated. When session is expired, you can still access that cookie. All you need to do is set its lifetime to be long enough.

You may implement your own Filter. I recommend extending UsernamePasswordAuthenticationFilter. Overriding Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) gives you access to cookies – you can add one with HttpServletResponse.addCookie(Cookie cookie).

You can easily inject your own filter. More info about config: http://static.springsource.org/spring-security/site/docs/3.1.x/reference/springsecurity-single.html#nsa-custom-filter

Also take into account that it can be insecure to send such a cookie. I don’t see any other way to accomplish what you want.
But you can easily improve security of this solution by configuring LogoutHandler. There is an implementation of this interface CookieClearingLogoutHandler. You can use it to clear that cookie when user decides to logout manually.

<bean id="cookieClearingLogoutHandler" class="org.springframework.security.web.authentication.logout.CookieClearingLogoutHandler">
    <constructor-arg>
        <!-- Names of the cookies you want to remove when user logs out -->
        <list>
            <value>username</value>
        </list>
    </constructor-arg>
</bean>

<bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">
    <constructor-arg value="/login"/>
    <constructor-arg>
        <array>
            <ref local="securityContextLogoutHandler"/>
            <!-- Inject it -->
            <ref local="cookieClearingLogoutHandler"/>
        </array>
    </constructor-arg>
    <property name="filterProcessesUrl" value="/logout"/>
</bean>