JSP中的登录页面会话超时问题

Question

How can we make login page sessionless ? I have tried using <%@page session="false" %> but it doesn't work if I open a login page and try using page after timeout (specified in web.xml) it won't login because my handshake encryption key stored in session is not available now and session is already invalidated.

How can we tell server not to create session for login page ? I am also using Spring security in my application if that can help.

Answer 1

Make change in web.xml and set session-timeout to -1 .

<session-config>
      <session-timeout>-1</session-timeout>
</session-config>

Now it will never expire.