每隔X分钟进行一次Spring Security身份验证（无终止会话）

Question

I am interested in asking users to re-authenticate after 15 mins of inactivity without killing their session (session life is longer).

Is there a way to specify an authentication timeout within Spring Security that would accomplish this automatically or some cleaver way I can accomplish this without too much effort?

Answer 1

Adding a request filter seems to be the best way to achieve this goal. In order to prevent the loss of data, I chose to have a blocking popup that displays if the session has been inactive. This way I can refresh the page and the user is right where they left off instead of needing to store the initial request and having to find it and redirect them.