Stormpath Spring Boot redirect loop

Question

Using Stormpath and Spring Boot (based on this tutorial), after I've started my server and successfully logged in with my credentials everything works fine. However when I exit the browser and try to open my application I get a redirect loop.

A minimal example is available here as an archive. It's a Gradle project. cd into the directory inside the archive and start the server with ./gradlew bootRun. The app will be accessible at http://localhost:8080. A Stormpath API key is needed for this. Register, get an API key and copy the apiKey-XXX.properties file to ~/.stormpath/apiKey.properties. This way Spring Boot will pick up the file and use it by default (only when you have a single application defined in Stormpath, that is).

Login, then quit your browser (on a Mac don't just close it with the red button, use command-q or right click on the browser's icon and quit it). Restart it and try access http://localhost:8080 once again. That's when I get the redirect loop. Tried it on Mac and Windows, Firefox and Chrome, same happens.

If I open the developer console I can see that first I'm redirected to the login page (fair enough), then I'm redirected to / (wierd) and so on...

When I login the first time I can see that a cookie with the name account is created for localhost and a JSESSIONID too. When I restart the browser the account cookie is intact and JSESSIONID is regenerated by the server. So I guess this behavior is related to the fact that JSESSIONID is bound to the login session or something.

Is there a way to configure this behavior? After a browser restart the user should be a) still logged in or b) be able to log again. Any idea?

_{Also, on a side note, I'm using an AngularJS app as my frontend. I don't think that should make any difference, but I though it could be important (the example app contains some AngularJS hello world code for this end).}

Update

The issue was flagged as a bug by Stormpath and after the release of com.stormpath.spring:stormpath-default-spring-boot-starter:1.0.RC8.1 it is now fixed. See the following answer and the comments for more detail.

There's a bug in Tomcat 8.0.30 that can cause behaviour like this. See github.com/spring-projects/spring-boot/issues/4937 for some more details and a possible workaround that might be worth a try — Andy Wilkinson
I wasn't able to run your app yet, but in the quickstart they said you should set a stormpath.application.href in your application.properties if you have more than one API key - and I can't find that configuration in the linked sources — Raffaele
@AndyWilkinson I don't think it's a Tomcat issue. On my dev machine I've an actual app which uses Jetty instead of Tomcat and I've experienced the same issue. — Kohányi Róbert

afitnerd afitnerd · Accepted Answer · 2016-01-19T23:37:10

I am Stormpath's Java Developer Evangelist.

I was not able to replicate the behavior using your zip file.

However, we have seen this before. It's related to browsers aggressively caching 302 redirects, especially against localhost.

Here's a reference that speaks to the issue in Chrome: http://kmarsden.com/chrome-redirect-cache/

Clearing cache should take care of the problem.

And, this would never happen in a production environment.

gif of Firefox interaction

Stormpath Spring Boot redirect loop

Update

1 Answers