3

I have a slight issue with my configuration of spring security and the InvalidSessionStrategy implementation I use.

Say a user is connected to the app and is viewing page: /userArea/thePage and their session times out, the user will first be redirected to the /signin page. Then, upon successful signin, they will be redirected to the home page of they personal area (/userArea) whereas I want them to come back to where they were located when the session timed out i.e. /userArea/thePage.

Is this possible?

If so how do I need to alter my config/app?

Here is my current config:

<beans:bean id="sessionManagementFilter" class="org.springframework.security.web.session.SessionManagementFilter">
        <beans:constructor-arg name="securityContextRepository" ref="httpSessionSecurityContextRepository" />
        <beans:property name="invalidSessionStrategy" ref="simpleRedirectInvalidSessionStrategy" />
    </beans:bean>

<beans:bean id="simpleRedirectInvalidSessionStrategy" class="org.springframework.security.web.session.SimpleRedirectInvalidSessionStrategy">
    <beans:constructor-arg name="invalidSessionUrl" value="/signin" />
    <beans:property name="createNewSession" value="true" />
</beans:bean>


<http auto-config="true" use-expressions="true">
        <custom-filter ref="sessionManagementFilter" before="SESSION_MANAGEMENT_FILTER" />
        <form-login login-processing-url="/resources/j_spring_security_check" login-page="/signin" authentication-failure-url="/signin?login_error=t" default-target-url="/userArea" />
        <logout logout-url="/resources/j_spring_security_logout" logout-success-url="/signin" />
...

edit 1: Let me better specify my requirements:

  • When a user session times out, I want the user to be redirected to the saved request (the url they requested before being redirected to the signin page).
  • However, when they initially signin with the app, I want them to be redirected to the home page of the personal area.

Are my requirements possible to implement using solution suggested by Carsten (see below)?

2 Answers 2

1

You could set the always-use-default-target="true" in the form-login tag. This redirects the user to the url they where trying to access before being intercepted to login.

But this will be the standard behaviour and not only in the case of a session timeout. Depending on the application this might not be what you want.

Edit: To do what you want you need to find a way to save the information on which page the user was when the session timedout. I don't know of any out of the box solution for this problem, since there is no state that indicates whether or not the user timed out or logged out manually.

What needs to be done ist to:

  1. set a flag or save the page-url on session timeout
  2. check in a custom AuthenticationSuccesHandler and redirect accordingling

If I would implement somehing like that I would most likely store the page-url. Also there are a few tricky things with this from an UX perspective. What happens if the saved page relies on a state achieved earlier? (I assume thats the reason you want the User to go to the default-url on normal login?) What happens if the user just does not log out shuts down sleeps for the night and logs in navigating to the login page (does the flag/page-url time out?)? etc.

In general I think it would be better use the always-use-default-target="true" since this adds the comfort of bookmarking any page and not having to navigate there at each login.

5
  • Thanks Carsten. I'll try that tonight and respond here accordingly.
    – balteo
    May 29, 2013 at 11:02
  • Hi Carsten. I have edited my post in order to better specify my requirements.
    – balteo
    May 29, 2013 at 11:28
  • Nope, my solution is atm definitly matching your requirements.
    – Carsten
    May 29, 2013 at 13:01
  • Ups missed the big fat NOT up there... well, updated the answer anyway.
    – Carsten
    May 29, 2013 at 13:10
  • Hi again! You're right: it is not feasible to save the request for an indeterminate amount of time (in case of a timeout). However, in order to save requests to say /userArea/thePage in case of a failed login, then one has to set always-use-default-target to false.
    – balteo
    May 29, 2013 at 19:52
0

Looks like it's common issue for any Spring project.

Spring developers thought that this is undocumented behavior https://github.com/spring-projects/spring-security/issues/1981, my business users are thinking that it's a bug. So, as a result we need to do some custom implementation))) Personally for me it's a bug and after making a custom implementation I don't understand why it's not fixed at Spring Framework.

As in a lot of other cases we have no choice and just copy-paste SimpleRedirectInvalidSessionStrategy and add our custom code.

You can even more simplify this code(I just make a customization which can be used OOTB in Spring):

public class CustomInvalidSessionStrategy implements InvalidSessionStrategy {

    private final Log logger = LogFactory.getLog(this.getClass());
    private String destinationUrl = null;
    private final RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
    private boolean createNewSession = true;

    public void onInvalidSessionDetected(HttpServletRequest request, HttpServletResponse response) throws IOException {
        this.logger.debug("Starting new session (if required) and redirecting to '" + this.destinationUrl + "'");
        if (this.createNewSession) {
            request.getSession();
        }

        if (destinationUrl == null) {
            this.redirectStrategy.sendRedirect(request, response, request.getRequestURI());
        } else {
            this.redirectStrategy.sendRedirect(request, response, this.destinationUrl);
        }
    }

    public void setCreateNewSession(final boolean createNewSession) {
        this.createNewSession = createNewSession;
    }

    public void setInvalidSessionUrl(final String invalidSessionUrl) {
        Assert.isTrue(UrlUtils.isValidRedirectUrl(invalidSessionUrl), "url must start with '/' or with 'http(s)'");
        this.destinationUrl = invalidSessionUrl;
    }
}

And some extra configuration for Spring security:

<security:http ...>
    ...
    <security:session-management invalid-session-strategy-ref="customInvalidSessionStrategy" />
    ...
</security:http>

<bean id="customInvalidSessionStrategy" class="com.custom.web.security.CustomInvalidSessionStrategy"/>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.