Spring – How to deal with session timeouts in AJAX requests

jsfjsf-2primefacesspringspring-security

I am using Spring-Security and Primefaces as view. How can i redirect user to login page after session timeout? I have a Tabview and several tabs inside it. so I need to deal with session timeouts in ajax requests. Is there any solution?

Spring-security.xml file

<beans:beans xmlns="http://www.springframework.org/schema/security"
         xmlns:beans="http://www.springframework.org/schema/beans" 
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">



<http auto-config='true' use-expressions="true">
    <intercept-url pattern="/login" access="permitAll"/>
    <intercept-url pattern="/pages/*" access="hasRole('admin')" />
    <intercept-url pattern="/j_spring_security_check" access="permitAll"/>        
    <logout logout-success-url="/login.xhtml" />
    <form-login login-page="/login.xhtml"
                login-processing-url="/j_spring_security_check"                                                       
                default-target-url="/pages/index.xhtml"
                always-use-default-target="true"                                                        
                authentication-failure-url="/login.xhtml"/>
</http>


<!--Authentication Manager Details -->    
<authentication-manager alias="authenticationManager">
    <authentication-provider user-service-ref="customUserDetailsService">
        <!--            <password-encoder hash="md5"/>-->
    </authentication-provider>
</authentication-manager>

Best Answer

If you put namespace configuration aside and use "pure" beans configuration, you could customize the ExceptionTranslationFilter to make it bypass the configured AuthenticationEntryPoint in the case of an ajax request. An example of this is explained in details here.

The idea of the ExceptionTranslationFilter is that it detects that an AuthenticationException or an AccessDeniedException as been thrown before executing the request. In these cases, normally it should launch the authenticationEntryPoint if the user is not logged in. In the case of an AccessDeniedException and the user is logged in, the ExceptionTranslationFilter would normally just return an http status code 403 (access forbidden).

But, if you can customize the ExceptionTranslationFilter as in the blog post mentionned above, you can detect if the rejected request is an ajax one by looking at the http headers. In this case, instead of calling the AuthenticationEntryPoint, wich would send a redirection, you can do as the thread balusC mentionned, but in the ExceptionTranslationFilter instead of doing it in a jsf ExceptionHandler.

Hope this help.

Related Topic