CODEWITHSUNDEEP
springspring-mvcspring-security
FelixM
FelixM

Reputation: 1506

Spring Security asks authenticated user to log in again and again

I am using Spring Security 3.0.2 on a web site where users can log into their account. The account landing page has a button that takes you to a second page. Various users report that they have trouble getting to that second page because they are asked to log in again and again when they press the button. I cannot reproduce the problem myself, and it seems to work for most people. However, enough people have complained about the issue that I take them seriously. What could be the cause for such a spurious malfunction?

Upvotes: 1

Views: 122

Answers (1)

jpprade
jpprade

Reputation: 3664

I see some possible cases maybe some of them would produce a 403 and not a redirect :

  • the second page is protected by a intercept-url with a list of role and some user doesn't have the required role. Maybe your account has some "admin" role which allow you to access any page that why you can not reproduce it
  • same problem but whith method @Secured with role that some users doesn't have
  • maybe these user aren't accepting cookie
  • maybe you have multiple domain the cookie is created for the domain www.domain.com then the user is redirected to another domain like www1.domain.com where the cookie doesn't apply.
  • maybe you have some kind of miss configuration in the load balancing the session is created on the 1st server, then the 2nd page is handled by the 2nd server where the session doesn't exists
  • maybe somewhere in the code you call session.invalidate()

hope it helps

Upvotes: 1

Related Questions