redirect the session timeout page in apache shiro

Question

I have login.xhtml, managePage.xhtml and sessionTimeout.xhtml. I want to redirect the sessionTimeout page when the session is time out. But it redirects to the login page whenever session is time out.

In the web.xml

<session-config>
    <session-timeout>1</session-timeout>
  </session-config>

  <error-page>
    <exception-type>javax.faces.application.ViewExpiredException</exception-type>
    <location>/sessionTimeout.xhtml</location>
  </error-page>

in shiro.ini

[main]
authc.loginUrl = /faces/loginPage.xhtml
authc.successUrl  = /faces/registerPage.xhtml
# ------------------------  
  ....
# -----------------------------------------------------------------------------  
[urls]  
/faces/protected/* = authc

I want to redirect the sessionTimeout page when session is time out.
I would like to know what different between /faces/protected/* and /faces/protected/**. I used one(*). It works.

Shouldn't you be checking on some SessionException. Something like ExpiredSessionException ? — TJ-

Wouter Wouter · Accepted Answer · 2014-08-12T06:22:27

If you add something like:

[urls]
/faces/sessionTimeout.xhtml = anon
/faces/protected/** = authc

The session timeout page is unprotected and it shouldn't redirect you to login. Or if the real path is without /faces:

[urls]
/sessionTimeout.xhtml = anon
/protected/** = authc

As for question two: the ** syntax is ant-style. It means everything in the directory, plus all below. So for example:

/foo/* matches on /foo/bar.html, but not on /foo/foo/bar.html.

When using /foo/** it matches on both.

For more information, check out http://ant.apache.org/manual/dirtasks.html in the section "Patterns".

redirect the session timeout page in apache shiro

1 Answers