SEC-2609: Add an InvalidSessionStrategy implementation for JSF

Mauro Molinari (Migrated from SEC-2609) said:

The only InvalidSessionStrategy implementation provided is SimpleRedirectInvalidSessionStrategy which simply does a redirect to the configured invalid session URL.
However in a JSF environments there's a common problem for which people are usually creating various kind of workarounds: when a JSF component in a page protected by Spring Security makes an Ajax request and the server session is invalid (i.e. expired), the SimpleRedirectInvalidSessionStrategy sends a redirect response to the client-side code that generated the request. However, this plain redirect is not handled correctly by the JSF JavaScript code and no actual redirection is performed. The actual result is that the user clicks on components in the page and nothing happens.

The correct way to handle these kind of requests is to reply with a proper Ajax response with the redirect URL, as described in the JSF specification:

<?xml version="1.0" encoding="UTF-8"?>
<partial-response>
  <redirect url="${redirectUrl}" />
</partial-response>

There are a couple of independent implementations around that do this, however having a suitable InvalidSessionStrategy built in in Spring Security would be very useful and would save a lot of headaches to many people.

As a starting point, two examples of a proper implementation are:

• http://anonsvn.icesoft.org/repo/icefaces3/tags/icefaces-3.0.1/icefaces/tutorials/booking-icefaces/src/main/java/com/icesoft/spring/security/JsfRedirectStrategy.java : this is used by myself with success with Spring Security 3.0.3 (it implements the old RedirectStrategy
• https://gist.github.com/banterCZ/5160269 : I don't have tested this, but it implements the new InvalidSessionStrategy

Please note that improving the <security:session-management> namespace tag to be able to specify a proper InvalidSessionStrategy would also help a lot in these scenarios ;-)

Start by reviewing InvalidSessionStrategy and the existing SimpleRedirectInvalidSessionStrategy implementation. Check how session-management handles invalid sessions and how the strategy can produce the JSF partial-response redirect format; done means JSF Ajax requests receive that response and the strategy can be used through the session-management configuration.