How to handle authentication through AJAX with a java web app that uses form based login

Question

I have a java web application running on WebSphere 7. The application uses form authentication method and part of the application accesses some protected resources using ajax requests. However, when the user's session expires, I am getting the login page in place of the content that is supposed to be refreshed by the ajax request.

Is there a good way to handle this problem? WebSphere returns a response status 200 with the login page so I cannot rely on that.

Maybe there is a way to tell the server that basic authentication should be used in certain circumstances but I don't know how.

I also thought of checking first if the session is new by making a request to unprotected resources first then return a certain status but it looks like a code smell solution...

Answer 1

You can send back some unique response or some error code(make sure you wont get this error code as valid response in any case) when the user session is not there to the Ajax call from WebSphere. And in the Ajax call method, on process response, check whether its error code.If its error code, redirect him to login page or do what ever and other case will be the valid data.

Answer 2

This is how I handled it in a similar situation. In our case, the AJAX response is always JSON. When the login expires, the authentication filter always sends a login form in HTML. So I check the content-type like this,

 if ((this.getHeader('Content-type') || '').include('application/json'))

If it's not JSON, I simply redirect to another protected page, which will trigger a full screen login and then that page will direct user back to the AJAX page.