How to Redirect to Login Page When Session Is Expired in Java Web Application

How to redirect to Login page when Session is expired in Java web application?

You could use a Filter and do the following test:

HttpSession session = request.getSession(false);// don't create if it doesn't exist
if(session != null && !session.isNew()) {
    chain.doFilter(request, response);
} else {
    response.sendRedirect("/login.jsp");
}

The above code is untested.

This isn't the most extensive solution however. You should also test that some domain-specific object or flag is available in the session before assuming that because a session isn't new the user must've logged in. Be paranoid!

how can i redirect to login page after session time out in jsp?

Two things

1. Configure a Welcome page as Login Page in web.xml
2. Create a filter and configure in web.xml , this should be the first filter in web.xml
3. In the filter check if the session is new the user should be guided to the login page , else the request should be processed.

JSF Redirect to Login page after session expired throws ViewExpiredException

Well, I belive I found the problem, Can't explain why, but as soon as I changed the url-pattern from:

<servlet-mapping>
  <servlet-name>Faces Servlet</servlet-name>
  <url-pattern>*.jsf</url-pattern>
  <url-pattern>*.xhtml</url-pattern>
  <url-pattern>*.html</url-pattern>

To:

<servlet-mapping>
  <servlet-name>Faces Servlet</servlet-name>
  <url-pattern>/faces/*</url-pattern>
</servlet-mapping>

It started working again. That's a shame. I didn't want the to have this pattern.

How to redirect jsp page after session expired?

I tried this and its working fine for me.

<%
    if(session.getAttribute("email") == null) {
       response.sendRedirect("login.jsp");
       return ;
    }
%>

I just put return statement and It will redirect to "login.jsp" when the session is expired.

Redirecting to login page after Session Expired in Spring

There really isn't a good way to determine what role the user is in once the HTTP session expires because once it expires the user information is gone.

You cannot do a redirect from a ApplicationListener because a session may expire when the users browser is not making a request (we cannot push information to the browser unless there is a connection open).

The best solution I can give you is to set a cookie that indicates which role the user is in. The cookie would outlive the session and then you can perform a redirect to the appropriate log in page based on the cookie.

Of course this fails if multiple different types of users are using the same computer because they share the same cookies.

How to redirect to login page after a inactive time?

I Solve my problem by adding JavaScript on each page except login page, I set it the timeout 15 minutes then redirect to login page and call logout function automatically.

<script>
            var time = new Date().getTime();

            document.onmousemove = function(event) {
                time = new Date().getTime();
            }

            document.onkeypress = function() {
                time = new Date().getTime();
            }

            function refresh() {
                if (new Date().getTime() - time >= 900000) {
                    document.getElementById("hiddenForm:gotoRegButton").click();
                    alert("Session expired please login again");
                    location.href = '../../../login/';
                } else {
                    setTimeout(refresh, 900000);
                }
            }

            setTimeout(refresh, 1000);
        </script>

        <h:form id="hiddenForm" style="display: none;">
            <h:commandButton id="gotoRegButton"
                action="#{mbLogin.logout()}" >
                <f:ajax execute="@form" render="statsData" />
                </h:commandButton>
        </h:form>

And for prevent accessing any another page when login flag is false, I added a below function on each page which checks the login flag before go to requested URL.

 @PostConstruct
    /////////////////////////////////////////////////////
    public void checkLoginFlag() {
        boolean loginFlag = LoginController.loginFlag;
        if (!loginFlag) {
            redirect("../../login");
        }
    }

Spring security auto redirect to login page after session timeout

Found a solution. Spring security is unable to solve it, I used JavaScript. This solution sends request every minute and if response data is not null, redirect occurs. It works only with one logged in user in browser.

Header html page

<script>
            setInterval(function() {
                $.ajax({
                    url: "/check-session",
                    method: "GET",
                    contentType: 'application/json; charset=utf-8',
                    success: function(data){
                        if (data && data.length > 0) {
                            window.location.replace("/login");
                        }
                    },
                    error: function (data) {
                        console.log("error");
                        console.log(data);
                    }
                })
            }, 60000);
    </script>

LoginController

@GetMapping("/check-session")
public ResponseEntity<String> checkSession() {
    return new ResponseEntity<>(HttpStatus.OK);
}

---

Related Topics