如果spring security session超时，如何在尝试执行ajax请求后将用户重定向到登录页面？

Question

I have spring boot app with spring security. I need check redirect to login page if user make request after session time out. I have 2 page: login and index . On index page I get requests by Ajax .

I open index page. wait 30 sec. Try update page after Session timeout but I not redirect to login page. But if I try update page F5 spring redirect me to login page. But if I try make ajax request - it work find and I not redirect.

It is my configs:

http.authorizeRequests().
                antMatchers("/css/**").permitAll()
                .antMatchers("/", "/index/**").hasRole("USER")
                .anyRequest().hasRole("USER")
                .and()
                .formLogin()
                .loginPage("/login").permitAll().defaultSuccessUrl("/index")
                .and()
                .logout().logoutUrl("/logout").permitAll().logoutSuccessUrl("/login");
        http.csrf()
                .disable()
                .authorizeRequests()
                .antMatchers("/resources/**", "/**").permitAll()
                .anyRequest().permitAll()
                .and();

and button on index page:

<button type="button" class="btn btn-primary" onclick="reload()">show</button>

and js method:

function reload() {
        table.ajax.reload(null, false);
    }

When I press "show" button - my table send request to spring controller(Session already invalid) and controller return data and table update success/ But I need redirect user to login page.

Answer 1

http
    .authorizeRequests()
        .antMatchers("/css/**", "/resources/**").permitAll()
        // ??? .antMatchers("/", "/index/**").hasRole("USER")
        .anyRequest().hasRole("USER")
        .and()
    .formLogin()
        .loginPage("/login").permitAll()
        .defaultSuccessUrl("/index")
        .and()
    .logout()           
         .logoutUrl("/logout").permitAll().logoutSuccessUrl("/login")
        .and()
    .csrf()
        .disable();

Can you try this ? and .antMatchers("/", "/index/**").hasRole("USER") is very confused.