spring-projects / spring-projects/spring-security
SEC-3125: how to distinguish session timeout from exceeding the maxSession
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
xtf (Migrated from SEC-3125) said:
I have set up session-management below:
My purpose is to make users know whether his account is timeout or has been logined in annother machine.
I expect that when the session timeout, the redirect url will be /login?sessionTimeout",and when the session exceeded,the redirect url will be /login?sessionExceeded
But in fact, the redirect url of both condition is "login?sessionTimeout". if i setup the invalid-session-url, the expire-url will not work. If i don't setup the invalid-session-url, the expire-url works when session exceeded, but when session timeout, it will not give any hint instead of redirecting to /login directly.
I want to know how to distinguish both conditions.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the session-management configuration shown in the issue, focusing on invalid-session-url and concurrency-control with expired-url. Trace how session timeout and maximum-session expiration are handled; done means the two conditions can be distinguished and redirected to their respective URLs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100