session is lost after successful login?

Question

greetings all um using spring security 3.0.2,all the application pages are secured to see them you must be authenticated um using https protocol i have a strange problem that after successful login and got to the requested page when try to open any link to other pages in the application the session is invalidated or lost or what happened i don't know and the user become anonymous,and redirected to the login page and i got this from debugging:

No HttpSession currently exists
No SecurityContext was available from the HttpSession: null. A new one will be created.

after reviewing the coe many times,nothing in the code is invalidating the session,any ideas why something like this might happen?

Answer 1

app-security,xml:

<beans:beans xmlns="http://www.springframework.org/schema/security"  
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                        http://www.springframework.org/schema/security 
                        http://www.springframework.org/schema/security/spring-security-3.0.xsd"&gt;

    <global-method-security pre-post-annotations="enabled">  

    </global-method-security>
    <http use-expressions="true" disable-url-rewriting="true">  
         <remember-me token-repository-ref="tokenRepository"
         token-validity-seconds="1209600"/>
        <access-denied-handler error-page="/error.jsp"/> 

        <intercept-url pattern="/" access="permitAll" />
        <intercept-url pattern="/**/images/**" filters="none" /> 
        <intercept-url pattern="/**/files/**" filters="none" />
        <intercept-url pattern="/images/**" filters="none" />
        <intercept-url pattern="/scripts/**" filters="none" />
        <intercept-url pattern="/styles/**" filters="none" />
        <intercept-url pattern="/p/login" filters="none" />
        <intercept-url pattern="/p/register" filters="none" />
        <intercept-url pattern="/p/forgotPassword" filters="none" />
        <intercept-url pattern="/p/changePassword" filters="none" />
        <intercept-url pattern="/p/**" access="isAuthenticated()"  />
        <custom-filter position="LAST" ref="rememberMeFilter"/>    
        <form-login                 
            login-processing-url="/j_spring_security_check"         
            login-page="/p/login"
            authentication-failure-url="/p/login?login_error=1"     
            authentication-success-handler-ref="myAuthenticationHandler"            
        />

        <logout />
    </http>

    <beans:bean id="myAuthenticationHandler" class="com.myAuthenticationHandler" />
    <beans:bean id="rememberMeFilter" class="com.rememberMeFilter" />

    <beans:bean id="tokenRepository" class="org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl">
    <beans:property name="dataSource" ref="dataSource"/>
    </beans:bean> 


    <authentication-manager alias="authenticationManager">  
    <authentication-provider>

            <password-encoder hash="md5"/>           
             <jdbc-user-service data-source-ref="dataSource"
             users-by-username-query="SELECT u.username,u.password,u.enabled   
                                FROM Users u where u.username=lower(?)"    
        authorities-by-username-query="SELECT a.username,a.authority    
                                FROM Users u, authorities a   
                                WHERE u.username=a.username
                                and u.username=lower(?) and enabled=1"/>

        </authentication-provider>
    </authentication-manager>

    </beans:beans>

Answer 2

Could be an cookie domain or cookie path problem. Is you're https login page on the same path/domain?