如何在不使用spring安全性的情况下限制登录用户在spring中访问登录页面？

Question

I am new to Spring and developing a dynamic web application in Spring and Tomcat and for some reason
I am not using Spring Security . I want to prevent users to access the login page who
are already in a session.Here is my code:

@Controller  
@RequestMapping("/login")  
@SessionAttributes("userAuthenticator")  
public class LoginController {  

    @RequestMapping(method = RequestMethod.GET)  
    public String showLogin(ModelMap model, HttpServletRequest request) {  
    System.out.println("Current Session: " + request.getSession(false));  

    if (request.getSession(false) == null) {  
    System.out.println("This means a new user wants to access the login page");  
    return "login";  
    }  

    else{  
    //means the user is already in session.So move him to another page say display.jsp  
    //actually I have done here with some other checking like getUserName() from   
    the model "UserAuthenticator" and if its again null redirect to login page.  
    }  

For Now forget about the else part.When I entered the URL in my browser
first time: ..../AccountCreation/login.htm
Console Output:

Current Session: null  
This means a new user wants to access the login page  

Looks absolutely normal because a new user is accessing the page(login page also appears).

But when I re-enter the URL even refresh the page the console output comes:

Current Session: org.apache.catalina.session.StandardSessionFacade@511e0a  

Where did that session come from ?
(For that reason, in my else part I got:"The webpage has a redirected loop" in my browser)

Can anyone suggest me a way to achieve my goal without using Spring Security ?
This is very much needed for me now.....

Thanks...

Answer 1

You can use a session variable.

HttpSession ses=request.getSession(false);
if(ses.getAttribute("sessionVar") == null)
     //show login page
else
     // don't show login page

Setting up session variable:

 HttpSession ses=request.getSession();
 ses.setAttribute("sessionVar","someValueToShowSession");

Answer 2

A session starts as soon a user makes a first request to the page. So second visit will always give a valid session.

If you want to check if he is authenticated user or not then you need to put yourself some flag/value in the session. Something like the userId. Tehn you can check

if userId is set in session -> valid user -> redirect.

if userId not set in session-> not logged in user -> allow login page.

Answer 3

This is expected behavior only. When you login for the first time a session is created and jsessionid cookie is stored on the browser. Unless you invalidate the session using session.invalidate() or session expired due to session-timeout that HttpSession will be available for that browser window.

If you want to restrict the user who is already login to see the login page by typing login page url then create an interceptor and check whether user is already logged in there or not. If the user is already logged in then redirect him to home page...otherwise allow him to go to login page.