Infinite redirect loop when invalid url is requested with remember me user and session timed out

Summary

If a user is authenticated with remember me, and the session times out after the default 30 minutes, then when an invalid URL is requested, an infinite redirect loop occurs in the handling of the AccessDeniedException.

Actual Behavior

1. User logs in with remember me
2. After 30 minutes the session times out
3. An invalid URL is requested (e.g. localhost:8080/invalidurl)
4. remember-me token detected and accepted in filter chain
5. AccessDeniedException is thrown due to bad URL
6. ExceptionTranslationFilter handles exception. With authenticationTrustResolver.isRememberMe(authentication) true, exception is handled with call to sendStartAuthentication
7. The Authentication entry point is called, and remember-me token is detected and accepted again in the filter chain populating the SecurityContextHolder
8. A redirect to the invalid URL saved in the DefaultSavedRequest is executed
9. Go to Step 5 (infinite loop)

Expected Behavior

When the session is still valid with a remember me user, an invalid URL is handled by the accessDeniedHandler in the ExceptionTranslationFilter. The expected default behavior would be the same when the session is timed out after 30 minutes.

Version

4.2.4

Start by tracing the ExceptionTranslationFilter, authenticationTrustResolver, sendStartAuthentication, and DefaultSavedRequest paths described in the report. Reproduce the remember-me timeout and invalid-URL sequence, then verify that the accessDeniedHandler handles the request without redirecting back into the loop.