Spring Security session timeout issue when accessing root "/"

1
votes

I am trying to implement session timeouts with spring security. I have web.xml and the security context setup, but I am having a problem when a user tries to access the root "/". Spring thinks that it is an invalid session (because technically it is) and redirects to /sessiontimeout.

Is there anyway to ignore this initial invalid session because the user has not logged in yet? Or differentiate between an expired session and one that is invalid?

web.xml

<session-config>
    <session-timeout>1</session-timeout>
</session-config>

security context

<security:session-management invalid-session-url="/sessiontimeout" />

Or I can take the easy way out and add some javascript to each page...

1
spring-mvcspring-securitytimeout

1 Answers

2
votes

An "invalid session" isn't one where the user hasn't authenticated. It's when the browser submits a JSESSIONID cookie for an old session, for example when it has timed out but also potentially when the user has logged out but the cookie is still present.

Most likely this is what you are seeing. You can configure Spring Security to try to delete the session cookie when a user logs out, as explained in the reference manual.