We are using 'Struts2' with 'Spring-core and Spring-security' frameworks. When the page is loaded for the first time, The user is redirected to homepage.
This is causing issues when we send specific link on mails, as the user has to click twice on it.
I've checked in dept and I've found out that the SessionManagementFilter is performing a HTTP 302 redirect to "/" because of the 'invalidSessionStrategy'.
SimpleRedirectInvalidSessionStrategy (class of Spring Security)
public void onInvalidSessionDetected(HttpServletRequest request, HttpServletResponse response) throws IOException {
logger.debug("Starting new session (if required) and redirecting to '" + destinationUrl + "'");
if (createNewSession) {
request.getSession();
}
redirectStrategy.sendRedirect(request, response, destinationUrl);
}
My 'application-context-security.xml' :
<global-method-security pre-post-annotations="enabled">
<expression-handler ref="expressionHandler" />
</global-method-security>
<http auto-config="false" use-expressions="true"
authentication-manager-ref="authenticationManger">
...
<form-login login-page="/" default-target-url="/secure/"
always-use-default-target="false" authentication-failure-url="/?login_error=true"
login-processing-url="/login" />
<logout logout-url="/secure/logout" logout-success-url="/" />
<session-management invalid-session-url="/" />
<logout delete-cookies="JSESSIONID" />
<session-management>
<concurrency-control max-sessions="1" />
</session-management>
</http>
How can I prevent Spring to perform a redirect for some url, or to redirect it to the requested url ?
EDIT : Here are my web.xml filters. I analyzed and even removed urlrewrite, it doesn't have any impact.
<filter>
<filter-name>UrlRewriteFilter</filter-name>
<filter-class>org.tuckey.web.filters.urlrewrite.UrlRewriteFilter</filter-class>
</filter>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter>
<filter-name>action</filter-name>
<filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>UrlRewriteFilter</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
</filter-mapping>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
</filter-mapping>
<filter-mapping>
<filter-name>action</filter-name>
<url-pattern>*.action</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
</filter-mapping>
<filter-mapping>
<filter-name>action</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
</filter-mapping>
<filter-mapping>
<filter-name>action</filter-name>
<url-pattern>/struts/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
</filter-mapping>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<listener>
<listener-class>
org.springframework.web.context.request.RequestContextListener
</listener-class>
</listener>
<listener>
<listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>
<session-config>
<session-timeout>60</session-timeout>
</session-config>