Handling 'session expired' in JSF web application, running in JBoss AS 5

Question

This question is related to my other question "How to redirect to Login page when Session is expired in Java web application?". Below is what I'm trying to do:

1. I've a JSF web application running on JBoss AS 5
2. When the user is inactive for, say 15 minutes, I need to log out the user and redirect him to the login page, if he is trying to use the application after the session has expired.
3. So, as suggested in 'JSF Logout and Redirect', I've implemented a filter which checks for the session expired condition and redirects the user to a session-timed-out.jsp page, if the session has expired.
4. I've added SessionExpiryCheckFilter on top of all other filter definitions in web.xml, so that my session expiry check will get the first hit always.

Now comes the challenge I'm facing. Since I'm using JBoss AS, when the session expired, JBoss automatically redirects me to the login page (note that the session expiry check filter is not invoked). So, after I log-in, my SessionExpiryCheckFilter intercepts the request, and it sees a session is available. But, it throws the exception javax.faces.application.ViewExpiredException: viewId:/mypage.faces - View /mypage.faces could not be restored.

Have anyone faced this issue before? Any ideas to solve this issue?

Answer 1

I would suggest writing a session listener in conjunction with the filter.

When the session expires you can create a new session object and set a timeout value on the new object.

Just check for the timeout value in the filter and redirect the browser.

See http://www.java2s.com/Code/Java/Servlets/Servletsessionlistener.htm

Answer 2

hey i have done it but for me its not working plz help me...

my session is expired in my jsp page but its not redirects to my login page...

i did the above xml mapping too...

Answer 3

If you are using Mojarra/Sun RI you might want to try to add this to your web.xml:

<context-param>
    <param-name>com.sun.faces.enableRestoreView11Compatibility</param-name> 
    <param-value>true</param-value>
</context-param>

However be aware that this isn't always the perfect solution. It hides the fact that the user has lost its session.