tags:

views:

262

answers:

0
+1  Q: 

Spring Security & CAS - Viewing secured page without login in

Hello, I have a webapp that uses Spring Security and SSO with CAS. There's also another webapp (in Classic ASP) that connect to CAS. And this situation happens sometimes:

Logged in to Java webapp and do stuff. 12 hours later (session has expired long ago) user goes to same page and it displays without redirecting to login page. This page has nocache for various web browsers so that should not be an issue.

If the user goes to the asp webapp. It asks for login so my guess is that cas had no ticket assigned for the user but how could he see the java web page?

Any help will be appreciated. Thanks

related questions

What is typically the length of your optimal coding session?
What's the most current, good practice, and easiest way to use sessions in PHP?
What can cause an ASP.NET worker process to be recycled?
How do I explicitly set asp.net sessions to ONLY expire on closing the browser or explicit logou?
session variable mixup in ASP.NET?
In Classic asp, can I store a database connection in the Session object?
What are the advantages and disadvantages of the Session Façade Core J2EE Pattern?
Different values of GetHashCode for inproc and stateserver session variables
Best way for allowing subdomain session cookies using Tomcat
Is there a way to specify a different session store with Tomcat?
PHP: $_SESSION - What are the pros and cons of storing temporarily used data in the $_SESSION variable
What is the best way to handle sessions for a PHP site on multiple hosts?
How much data can/should you store in a users session object?
ASP.Net Session_Start event not firing
Logging image downloads
ASP.Net: If I have the Session ID, Can I get the Session object?
Secure session cookies in ASP.NET over HTTPS
Django Sessions
Can I put an ASP.Net session ID in a hidden form field?
Always including the user in the django template context
Rails - recovering database from Production.log
Most efficient way to get data from the database to session
What is the best way to prevent session hijacking?
FOSS ASP.Net Session Replication Solution?
How do I best detect an ASP.NET expired session?