会话超时后，Spring安全性不会重定向到上次请求的页面登录

Question

I'm using Spring Security 4.2.2.RELEASEin my application. Once timeout happens and then user click any URL, it gets redirected to logout page and once the authentication is a success, it redirects to the default Home page, not the requested page.

The web xml is as follows:

<bean id="logoutSuccessHandler"
         class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler">
         <property name="useReferer" value="true"/>
     </bean>


    <security:form-login
            login-page="/login"
            authentication-failure-url="/login_error"
            username-parameter="username"
            password-parameter="password"
            default-target-url="/home"
            always-use-default-target="false"
            />

I want it to redirect to the requested page once the authentication is correct. I have read that this feature is provided default with Spring Security. But it was not working , so i was trying to implement using SimpleUrlLogoutSuccessHandler. But still couldnt find way around it. So what could be gone wrong here?

Answer 1

Well, you need to implement SimpleUrlAuthenticationSuccessHandler . This help you in handling the redirections.

    <http>
    <intercept-url pattern="/login" access="permitAll"/>
    <intercept-url pattern="/**" access="isAuthenticated()"/>
    <form-login authentication-success-handler-ref="refererHandler" />
</http>

<beans:bean
  class="RefererRedirectionAuthenticationSuccessHandler"
  name="refererHandler"/>

And implementing like this:

    public class RefererRedirectionAuthenticationSuccessHandler 
  extends SimpleUrlAuthenticationSuccessHandler
  implements AuthenticationSuccessHandler {

    public RefererRedirectionAuthenticationSuccessHandler() {
        super();
        setUseReferer(true);
    }
    }

Answer 2

First enabling the concurrent session-control support is to add the following listener in the web.xml :

<listener>
    <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
  </listener>

  <session-config>
    <session-timeout>30</session-timeout>
  </session-config>

After the session has timed out, if the user sends a request with an expired session id, they will be redirected to a configurable URL. Similarly, if the user sends a request with a session id which is not expired, but entirely invalid, they will also be redirected to a configurable URL: security.xml

<session-management invalid-session-url="/sessionexpiredPage.htm" session-authentication-error-url="/forms/common/login.jsp?error=alreadyLoggedin" session-fixation-protection="none" >
            <concurrency-control expired-url="/sessionexpiredPage.htm" max-sessions="5" error-if-maximum-exceeded="true"  />
        </session-management>

Corresponding Java code:

@Audit(option = "Session Expire", action = "Session Expired")
    @RequestMapping(value = "/sessionexpiredPage.htm")
    public ModelAndView sessionExpired(HttpSession session, HttpServletRequest request) {
        clLogger.logMethodEntry("sessionexpiredPage");
        ModelAndView model = new ModelAndView();
        String userId = (String) session.getAttribute("USER_ID");
        if(userId == null) {
            model.setViewName("sessionexpiredPage");
        }else {
            model.setViewName("getHomePage");
        }
        clLogger.logMethodExit("sessionexpiredPage");
        return model;

    }