Null pointer exception while redirecting to the login page when the session expires?

Question

I need to redirect to the login page when the session expires.

I am using HttpSessionListener, it is calling the sessionDestroyed method, but I am not able to redirect to the login page.

I am getting Null pointer Exception while redirecting

Java Class

import com.and.web.util.FacesUtils;
import java.io.IOException;
import java.util.Date;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.servlet.http.HttpSession;
import javax.servlet.http.HttpSessionEvent;
import javax.servlet.http.HttpSessionListener;

public class MyHttpSessionListener implements HttpSessionListener {

    public void sessionCreated(HttpSessionEvent se) {
        HttpSession session = se.getSession();
        System.out.print(getTime() + " (session) Created:");
        System.out.println("ID=" + session.getId() + " MaxInactiveInterval="
                + session.getMaxInactiveInterval());
    }

    public void sessionDestroyed(HttpSessionEvent se) {
        HttpSession session = se.getSession();
        session.invalidate();
        try {
            FacesUtils.getExternalContext().redirect("/tnt-ui/");
        } catch (IOException ex) {
            Logger.getLogger(MyHttpSessionListener.class.getName()).log(Level.SEVERE, null, ex);
        }
        // session has been invalidated and all session data
        //(except Id)is no longer available
        System.out.println(getTime() + " (session) Destroyed:ID=" + session.getId());
    }

    private String getTime() {
        return new Date(System.currentTimeMillis()).toString();
    }
}

Web.xml

<listener>
    <listener-class>`com.and.web.bean.MyHttpSessionListener`</listener-class>
</listener>

How to do this? please give solution.

Answer 1

public void sessionDestroyed(HttpSessionEvent se) {
    HttpSession session = se.getSession();
    session.invalidate();
    try {
        FacesUtils.getExternalContext().redirect("/tnt-ui/");

This is not going to work. Redirects can only be issued during request processing. sessionDestroyed is generally a timeout event and will not be invoked by a request thread.

You could use (for example) a filter to detect expired sessions and redirect then.