会话过期后的 Ajax 调用未重定向到登录页面 - Spring Boot

Question

I want to redirect to the login page if while doing an ajax call the session is expired. I'm following the instructions on thislink to do that, but every time I do an ajax call with the session expired it returns the login page as part of the response instead of redirecting to the login page, this never fails and response always goes to success piece of the ajax call with readyState: 4 and status: 200 and this is giving me a jquery error because I'm expecting a list and it's returning the html code for the login page.

My code is as below:

WebSecurityConfig.java

@Override
protected void configure(HttpSecurity http) throws Exception {      

    http.authorizeRequests()
            .antMatchers(URL_LOGIN, "/css/**", "/img/**").permitAll()
            .antMatchers("/admin/**").hasAnyAuthority(authorizedRolesAdmin)
            .antMatchers("/**").hasAnyAuthority(ArrayUtils.addAll(authorizedRolesUser, authorizedRolesAdmin))
                .and()
            .formLogin()
                .loginPage(URL_LOGIN)                   
                .defaultSuccessUrl("/", true)               
                .failureUrl(URL_LOGIN_FAILED)
                .permitAll()
                .and()
            .logout()                   
                .logoutSuccessUrl(URL_LOGOUT)
                .deleteCookies("JSESSIONID")
                .invalidateHttpSession(true)
                .permitAll()
                .and()
            .exceptionHandling()                
                .accessDeniedPage(URL_LOGIN_UNAUTHORIZED)
                .authenticationEntryPoint(new AjaxAwareAuthenticationEntryPoint(URL_LOGIN))
                .and()
            .sessionManagement()
                .maximumSessions(1)
                .expiredUrl(URL_LOGOUT)
                .and()
                .invalidSessionUrl(URL_LOGOUT);
}

AjaxAwareAuthenticationEntryPoint.java

public class AjaxAwareAuthenticationEntryPoint extends LoginUrlAuthenticationEntryPoint {

    public AjaxAwareAuthenticationEntryPoint(String loginFormUrl) {
        super(loginFormUrl);        
    }

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
        String ajaxHeader = request.getHeader("X-Requested-With");
        if ("XMLHttpRequest".equals(ajaxHeader)) {
            response.sendError(HttpServletResponse.SC_FORBIDDEN, "Ajax Request Denied (Session Expired)");
        } else {
            super.commence(request, response, authException);
        }
    }

}

While debugging after session expired, I noticed that it doesn't even enter to: AjaxAwareAuthenticationEntryPoint java class commence method.

What I'm missing here?

Answer 1

I know, that it is probably too late for the answer, but anyway the code you've attached helped me to resolve the absolutely same issue. To be honest, I don't see any issues in your code that makes it not to enter to the AjaxAwareAuthenticationEntryPoint, only may be you have some other configs behind the scene. But anyway, let my answer be an example for everyone, who struggles with the same issue, cause for me it works fine, and returns 403 if session is expired. I am using Spring Boot v2.3.5 and this is my code:

AjaxAwareAuthenticationEntryPoint.java

public class AjaxAwareAuthenticationEntryPoint extends LoginUrlAuthenticationEntryPoint {

public AjaxAwareAuthenticationEntryPoint(String loginFormUrl) {
    super(loginFormUrl);
}

@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
    String ajaxHeader = ((HttpServletRequest) request).getHeader("X-Requested-With");
    if ("XMLHttpRequest".equals(ajaxHeader)) {
        response.sendError(HttpServletResponse.SC_FORBIDDEN, "Ajax Request Denied (Session Expired)");
    } else {
        super.commence(request, response, authException);
    }
}

}

WebSecurityConfig.java

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private AuthenticationFailureHandler authenticationFailureHandler;

    @Autowired
    private AccessDeniedHandler accessDeniedHandler;

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
                .csrf()
                .disable()
                .authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/login").permitAll()
                .antMatchers("/registration*").permitAll()
                .antMatchers("/admin/**").hasAuthority("ADMIN")
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .failureUrl("/login?error=true")
                .defaultSuccessUrl("/admin", true)
                .failureHandler(authenticationFailureHandler)
                .and()
                .logout()
                .invalidateHttpSession(true)
                .clearAuthentication(true)
                .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                .logoutSuccessUrl("/login")
                .and()
                .exceptionHandling()
                .accessDeniedHandler(accessDeniedHandler)
                .and()
                .exceptionHandling()
                .authenticationEntryPoint(new AjaxAwareAuthenticationEntryPoint("/login"));
    }

   

}

and inside my main.js where I have some jquery ajax calls I have this:

$(document).ajaxError(function myErrorHandler(event, xhr, ajaxOptions, thrownError) {
        if (xhr.status == 403) {
            window.location.href ="/login";
        }
    });