Styjun

Entering the US with dual citizenship but US passport is long expired?

Are there mathematical concepts that exist in the fourth dimension, but not in the third dimension?

Where on Earth is it easiest to survive in the wilderness?

How should Thaumaturgy's "three times as loud as normal" be interpreted?

Could this estimate of the size and mass of the Chicxulub Impactor be accurate?

What is the purpose of the rotating plate in front of the lock?

In-universe, why does Doc Brown program the time machine to go to 1955?

What drugs were used in England during the High Middle Ages?

Why did Boris Johnson call for new elections?

How to interpret or parse this confusing 'NOT' and 'AND' legal clause

"syntax error near unexpected token" after editing .bashrc

Do I need to declare engagement ring bought in UK when flying on holiday to US?

Opportunity profits vs. opportunity costs

How do I use NEC PC-6001 .p6 or .cas files?

Are language and thought the same?

How does the UK House of Commons think they can prolong the deadline of Brexit?

Why would image resources loaded from different origins triggering HTTP authentication dialogs be harmful?

How could a planet have one hemisphere way warmer than the other without the planet being tidally locked?

Why would one hemisphere of a planet be very mountainous while the other is flat?

What does it mean to count a group of numbers with their multiplicity?

How do I make my fill-in-the-blank exercise more obvious?

Why does the UK Prime Minister need the permission of Parliament to call a general election?

Is there some sort of French saying for "a person's signature move"?

Fantasy Military Arms and Armor: the Dwarven Grand Armory

How to override the SessionManagement filter for expired sessions

Get Session to expire gracefully in ASP.NETHow do I expire a PHP session after 30 minutes?Handling 'session expired' in JSF web application, running in JBoss AS 5How to expire session due to inactivity in Django?Transfer session across server in PHPSession Cookie Not Expiring in AndroidNode session cookie that expiresChecking session expiration in the browserhow to programmatically invalidate a session using spring securityHow to determine if a user's session has expired

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

0

So I will try and summarize the best way I know possible:

1) Tomcat session expiry is 20 minutes

2) User makes a request and gets a sessionID 123

3) User goes on break

4) User comes back and clicks on a link in app

5) Tomcat removes session so session id is invalid

Now what I want to happen is call the invalidSessionStrategy hook to clear the sessionID out of the cookie and return a 401 to my Angular code to prompt user for feedback to continue.

The problem that I am having is this code in the SessionManagementFilter:

if (request.getRequestedSessionId() != null && !request.isRequestedSessionIdValid()) 
 if (this.logger.isDebugEnabled()) 
 this.logger.debug("Requested session ID " + request.getRequestedSessionId() + " is invalid.");
 

 if (this.invalidSessionStrategy != null) 
 this.invalidSessionStrategy.onInvalidSessionDetected(request, response);
 return;
 

Since Tomcat expired the Session and the session id is no longer there, the getRequestedSessionId() !== null will return false and bypass my hook.

The isRequestedSessionIdValid() already checks to see if the getRequestedSessionId() is null and if so returns false. That first check getRequestedSessionId() is preventing me from getting the invalidSessionStrategy call back.

Has anyone experienced this? I have tried to subclass but cannot because of the private members..Does anyone else have any ideas?

Thank you so much in advance!

session spring-security

share|improve this question

edited Mar 28 at 4:28

Tiw

4,48066 gold badges1818 silver badges3030 bronze badges

asked Mar 27 at 19:09

thunderman74thunderman74

1

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Since Tomcat expired the Session and the session id is no longer there, the getRequestedSessionId() !== null will return false That's wrong, see getRequestedSessionId It returns the session ID from client's cookie.
  
  – dur
  Mar 28 at 8:23
  
  

  
  
  
  

add a comment | 

0

So I will try and summarize the best way I know possible:

1) Tomcat session expiry is 20 minutes

2) User makes a request and gets a sessionID 123

3) User goes on break

4) User comes back and clicks on a link in app

5) Tomcat removes session so session id is invalid

Now what I want to happen is call the invalidSessionStrategy hook to clear the sessionID out of the cookie and return a 401 to my Angular code to prompt user for feedback to continue.

The problem that I am having is this code in the SessionManagementFilter:

if (request.getRequestedSessionId() != null && !request.isRequestedSessionIdValid()) 
 if (this.logger.isDebugEnabled()) 
 this.logger.debug("Requested session ID " + request.getRequestedSessionId() + " is invalid.");
 

 if (this.invalidSessionStrategy != null) 
 this.invalidSessionStrategy.onInvalidSessionDetected(request, response);
 return;
 

Since Tomcat expired the Session and the session id is no longer there, the getRequestedSessionId() !== null will return false and bypass my hook.

The isRequestedSessionIdValid() already checks to see if the getRequestedSessionId() is null and if so returns false. That first check getRequestedSessionId() is preventing me from getting the invalidSessionStrategy call back.

Has anyone experienced this? I have tried to subclass but cannot because of the private members..Does anyone else have any ideas?

Thank you so much in advance!

session spring-security

share|improve this question

edited Mar 28 at 4:28

Tiw

4,48066 gold badges1818 silver badges3030 bronze badges

asked Mar 27 at 19:09

thunderman74thunderman74

1

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Since Tomcat expired the Session and the session id is no longer there, the getRequestedSessionId() !== null will return false That's wrong, see getRequestedSessionId It returns the session ID from client's cookie.
  
  – dur
  Mar 28 at 8:23
  
  

  
  
  
  

add a comment | 

So I will try and summarize the best way I know possible:

1) Tomcat session expiry is 20 minutes

2) User makes a request and gets a sessionID 123

3) User goes on break

4) User comes back and clicks on a link in app

5) Tomcat removes session so session id is invalid

Now what I want to happen is call the invalidSessionStrategy hook to clear the sessionID out of the cookie and return a 401 to my Angular code to prompt user for feedback to continue.

The problem that I am having is this code in the SessionManagementFilter:

if (request.getRequestedSessionId() != null && !request.isRequestedSessionIdValid()) 
 if (this.logger.isDebugEnabled()) 
 this.logger.debug("Requested session ID " + request.getRequestedSessionId() + " is invalid.");
 

 if (this.invalidSessionStrategy != null) 
 this.invalidSessionStrategy.onInvalidSessionDetected(request, response);
 return;
 

Since Tomcat expired the Session and the session id is no longer there, the getRequestedSessionId() !== null will return false and bypass my hook.

The isRequestedSessionIdValid() already checks to see if the getRequestedSessionId() is null and if so returns false. That first check getRequestedSessionId() is preventing me from getting the invalidSessionStrategy call back.

Has anyone experienced this? I have tried to subclass but cannot because of the private members..Does anyone else have any ideas?

Thank you so much in advance!

session spring-security

share|improve this question

edited Mar 28 at 4:28

Tiw

4,48066 gold badges1818 silver badges3030 bronze badges

asked Mar 27 at 19:09

thunderman74thunderman74

1

if (request.getRequestedSessionId() != null && !request.isRequestedSessionIdValid()) 
 if (this.logger.isDebugEnabled()) 
 this.logger.debug("Requested session ID " + request.getRequestedSessionId() + " is invalid.");
 

 if (this.invalidSessionStrategy != null) 
 this.invalidSessionStrategy.onInvalidSessionDetected(request, response);
 return;
 

share|improve this question

edited Mar 28 at 4:28

Tiw

4,48066 gold badges1818 silver badges3030 bronze badges

asked Mar 27 at 19:09

thunderman74thunderman74

1

share|improve this question

edited Mar 28 at 4:28

Tiw

4,48066 gold badges1818 silver badges3030 bronze badges

asked Mar 27 at 19:09

thunderman74thunderman74

1

edited Mar 28 at 4:28

Tiw

4,48066 gold badges1818 silver badges3030 bronze badges

edited Mar 28 at 4:28

Tiw

4,48066 gold badges1818 silver badges3030 bronze badges

asked Mar 27 at 19:09

thunderman74thunderman74

1

asked Mar 27 at 19:09

thunderman74thunderman74

1