CODEWITHSUNDEEP
springsessionspring-security
Bill
Bill

Reputation: 2633

How do I change session timeout for a single page under Tomcat running a Spring security controlled application?

Part of my application has a single page view for an overhead status board. Access to the server that runs the overhead display is in an access controlled location that only a few key people have access to. The problem I am encountering is that the session expires after a set amount of time, necessitating someone physically going to the server and reloading the page. Needless to say this creates some problems when the key people aren't around.

This application runs under Tomcat, and security is controlled via Spring security. How would I go about changing the session timeout for this page only?

[edit]

I've taken the approach that @sotirios-delimanolis suggested. Although I still need to find an elegant way to reverse the extended session timeout if the user navigates to this page then navigates away, this appears to work for me.

Following is the relevant snippet of code that implements this:

    @RequestMapping(value="BigBoard", method = RequestMethod.GET) 
    public void getBigBoard(HttpServletRequest request, Model model) {

         HttpSession session = request.getSession();
         session.setMaxInactiveInterval(604800);

Upvotes: 1

Views: 898

Answers (2)

Jukka
Jukka

Reputation: 4663

Make the page refresh itself every now and then (using <meta http-equiv="refresh" content="60">) or add some Ajax polling to avoid session timeout.

Upvotes: 0

Sotirios Delimanolis
Sotirios Delimanolis

Reputation: 279880

I don't know how your page is accessed, by controller, resource provider, etc. but you would have to add a Servlet, Filter, HandlerInterceptor or handler method somewhere in the processing of that request that basically did the following

int seconds = ...; // timeout
request.getSession(true).setMaxInactiveInterval(seconds);

That session now has the specified timeout before the container invalidates it.

Note that if the user goes to some other page somehow, the timeout for their session will remain what you set above unless you change it.

Upvotes: 1

Related Questions