spring-bootspring-securityvaadinsession-management

Spring boot expiredURL not working


I have "Vaadin 10 with Spring Boot" application. I want to allow user to access application from one place at a time. So I used maximumSessions(1). Example, from Chrome browser I have logged in with user "XYZ". Now with the same user (i.e. "XYZ") I tried to login to Opera browser. So as per configuration shown below, it will expire session of Chrome browser but it is not redirecting to "/login". It shows message "Invalid JSON response from Server". Below is the Spring security configuration:

@Override
protected void configure(HttpSecurity http) throws Exception {
    // Not using Spring CSRF here to be able to use plain HTML for the login page
    http.csrf().disable()

            // Register our CustomRequestCache, that saves unauthorized access attempts, so
            // the user is redirected after login.
            .requestCache().requestCache(new CustomRequestCache())

            // Restrict access to our application.
            .and().authorizeRequests()
            .antMatchers("/ForgetPassword","/ChangePassword","/login").permitAll()
            // Allow all flow internal requests.
            .requestMatchers(SecurityUtils::isFrameworkInternalRequest).permitAll()

            // Allow all requests by logged in users.
            .anyRequest().authenticated()
            // Configure the login page.
            .and().formLogin().loginPage("/login").permitAll().loginProcessingUrl("/login")
            .failureUrl("/login?error")

            // Register the success handler that redirects users to the page they last tried
            // to access
            .successHandler(new SavedRequestAwareAuthenticationSuccessHandler())

            // Configure logout
            .and().logout().logoutSuccessUrl(LOGOUT_SUCCESS_URL)
            .deleteCookies("JSESSIONID")
            //.invalidateHttpSession(true)
            .and()
            .sessionManagement()
            //.invalidSessionUrl("/login")
            .maximumSessions(1)
            //.maxSessionsPreventsLogin(false)
            .sessionRegistry(sessionRegistry())
            .expiredUrl("/login");

Solution

  • The problem is that, by redirecting the request, Vaadin receives the login page as a response to a internal request.

    This seems to work:

            .expiredSessionStrategy(e -> {
                final String redirectUrl = e.getRequest().getContextPath() + "/login";
                if(SecurityUtils.isFrameworkInternalRequest(e.getRequest())) {
                    e.getResponse().setHeader("Content-Type", "text/plain");
                    e.getResponse().getWriter().write("Vaadin-Refresh: " + redirectUrl);
                } else {
                    e.getResponse().sendRedirect(redirectUrl);
                }
            });
    

    It is documented in the ConnectionStateHandler

    public interface ConnectionStateHandler {
    
    /**
     * A string that, if found in a non-JSON response to a UIDL request, will
     * cause the browser to refresh the page. If followed by a colon, optional
     * whitespace, and a URI, causes the browser to synchronously load the URI.
     *
     * <p>
     * This allows, for instance, a servlet filter to redirect the application
     * to a custom login page when the session expires. For example:
     * </p>
     *
     * <pre>
     * if (sessionExpired) {
     *     response.setHeader(&quot;Content-Type&quot;, &quot;text/html&quot;);
     *     response.getWriter().write(myLoginPageHtml + &quot;&lt;!-- Vaadin-Refresh: &quot;
     *             + request.getContextPath() + &quot; --&gt;&quot;);
     * }
     * </pre>
     */
    String UIDL_REFRESH_TOKEN = "Vaadin-Refresh";