使javax.servlet.http.HttpSession在某些页面上不超时

Question

I'm refactoring an application which was doing its own session timeout management. I noted that the HttpSession supports setting a timeout value.

There is an event listener (HttpSessionListener I assume) that is redirecting to a 'timeout' page. "We're sorry your session expired, heres a link to the login page" kind of thing.

The problem is that when I first hit the app and am sitting on the login page, the session timeout event still fires. So I can be looking at the login page and get redirected to the timeout page.

What I want to happen is that if I am on the login page and only on the login page, that the session timeout does not occur. How do I do this?

I have already tried calling HttpSession.setMaxInactiveInterval(-1) in the default view resolution in the login's ActionBean, but that did not work.

I believe the session is being created, but not necessarily authenticated, whenever any page is accessed.

Answer 1

Where do you have the redirecting happening? If it's something declaratively set somewhere in a configuration file you could remove it and implement the HttpSessionListener interface.

In the sessionDestroyed method u would make the following:

• Get the session from the sessionEvent
• If the session contained an authentication flag then redirect

U could also keep the last page requested by the user and use that as a reference to determine whether to redirect or not but what do you do if a user is already authenticated and browses to the login page? I do not have a lot of information about your application.

Anyway the HttpSessionListener is the way to go I think.