CODEWITHSUNDEEP
springsessionspring-securitysession-timeout
Andrey Minogin
Andrey Minogin

Reputation: 4615

Spring security session expiration

  1. What is the maximum time of user inactivity (session expiration time) when using spring security?
  2. When is session expiration date updated? Does it update when we call SecurityContextHolder.getContext().getAuthentication() ? I.e. what is "user activity" for spring security?

Thanks!

Upvotes: 1

Views: 6031

Answers (1)

axtavt
axtavt

Reputation: 242786

Spring Security relies on session management support provided by servlet containers.

  1. Session timeout can be configured in web.xml: 

    <session-config>
    <session-timeout>30</session-timeout> <!-- in minutes -->
</session-config>

    otherwise container's default value is used. You can override timeout for particular session using Session.setMaxInactiveInterval() (in seconds).

  2. Session expiration date is updated when any request associated with that session comes in.

Upvotes: 10

Related Questions