Package com.vaadin.flow.spring.security

Class VaadinExpiredSessionStrategy

java.lang.Object
com.vaadin.flow.spring.security.VaadinExpiredSessionStrategy
All Implemented Interfaces:
org.springframework.security.web.session.SessionInformationExpiredStrategy
public class VaadinExpiredSessionStrategy extends Object implements org.springframework.security.web.session.SessionInformationExpiredStrategy
A strategy to handle expired sessions which is aware of Vaadin requests.

When Spring Security concurrency control detects an expired session, it has already logged the user out and invalidated the HTTP session. Instead of writing a response the Vaadin client cannot make sense of, this strategy lets the request continue through the filter chain, so that it is answered like any other request that arrives without a session: Vaadin answers a UIDL request with a session expired message, a heartbeat with 403 and a push request through its own handler, while a request for a view ends in the login view of the application.

Since:
25.4

  • Constructor Details

    • VaadinExpiredSessionStrategy

      public VaadinExpiredSessionStrategy()
      Creates the strategy.

  • Method Details

    • onExpiredSessionDetected

      public void onExpiredSessionDetected(org.springframework.security.web.session.SessionInformationExpiredEvent event) throws IOException, jakarta.servlet.ServletException
      Specified by:
      onExpiredSessionDetected in interface org.springframework.security.web.session.SessionInformationExpiredStrategy
      Throws:
      IOException
      jakarta.servlet.ServletException