Spring Security part VI : Session Timeout handling for Ajax calls

Recently when developing the Tatami application for the Twitter-like contest, I faced an annoying issue: how to detect an user session timeout when an Ajax request is triggered from the browser ?

If you’re not familiar yet with Spring Security, you can check my previous articles on this framework.

In this article we’ll see a solution based on Spring Security filter. For those who don’t use Spring Security I’ll show another approach with servlet filter.

Please note that a demo application for this article can be found on GitHub https://github.com/doanduyhai/AjaxSessionExpiration

Edit: the implementation has been changed to simplify Ajax request detection thanks to Marty Jones suggestions.
 

I The problem

Nowadays mobile development is getting more and more important for the business. Many companies provide a mobile interface of their traditional desktop website to address a larger audience.

The corner-stone of mobile architecture are RESTfull webservices. The underlying implementation relies on Ajax calls to achieve content lazy loading.

If your resources is protected by a security framework any un-authenticated request will be rejected and the framework redirects you to a login page. The same mechanism applies if the request is Ajax-based.

However, at the XMLHttpRequest level, it is not possible to detect this redirection. According to the W3C specs, the redirection is taken care at browser level and should be transparent for the user (so transparent for the XMLHttpRequest protocol too). What happens it that the Ajax layer receives an HTTP 200 code after the redirection.

This issue has been widely debated on Stackoverflow at this thead.
Many contributors suggest to add a special attribute in the JSON response to indicates a redirect or to add a special Javascript callback to parse the response string searching for a DOM element that characterizes the login page and so on.

My opinion is that all these solutions are not satisfactory because they require many hacks and tamper with the response string/content itself.
 

II The solution

A Spring Security

1) Algorithm

Since it is clear that it’s not possible to detect an HTTP Redirect at Javascript level, the job should be done at server side.

The idea is to add a special filter in the Spring Security chain to detect a session timeout and an incoming Ajax call then return an custom HTTP error code so the Ajax callback function can detect and process properly.

Below is a pseudo-code of the filter implementation:

• If not authenticated
  • Redirect to login page
• If the access to the resource is denied
  • If the session has expired and the request is Ajax-based
    • Return custom HTTP error code
  • Else
    • Redirect to login page
• Else
  • Redirect to login page

2) Implementation

We should create a custom filter class implementing the org.springframework.web.filter.GenericFilterBean interface.

public class AjaxTimeoutRedirectFilter extends GenericFilterBean
{

	private static final Logger logger = LoggerFactory.getLogger(AjaxTimeoutRedirectFilter.class);

	private ThrowableAnalyzer throwableAnalyzer = new DefaultThrowableAnalyzer();
	private AuthenticationTrustResolver authenticationTrustResolver = new AuthenticationTrustResolverImpl();

	private int customSessionExpiredErrorCode = 901;

	@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException
	{
		try
		{
			chain.doFilter(request, response);

			logger.debug("Chain processed normally");
		}
		catch (IOException ex)
		{
			throw ex;
		}
		catch (Exception ex)
		{
			Throwable[] causeChain = throwableAnalyzer.determineCauseChain(ex);
			RuntimeException ase = (AuthenticationException) throwableAnalyzer.getFirstThrowableOfType(AuthenticationException.class, causeChain);

			if (ase == null)
			{
				ase = (AccessDeniedException) throwableAnalyzer.getFirstThrowableOfType(AccessDeniedException.class, causeChain);
			}

			if (ase != null)
			{
				if (ase instanceof AuthenticationException)
				{
					throw ase;
				}
				else if (ase instanceof AccessDeniedException)
				{

					if (authenticationTrustResolver.isAnonymous(SecurityContextHolder.getContext().getAuthentication()))
					{
						logger.info("User session expired or not logged in yet");
						String ajaxHeader = ((HttpServletRequest) request).getHeader("X-Requested-With");

						if ("XMLHttpRequest".equals(ajaxHeader))
						{
							logger.info("Ajax call detected, send {} error code", this.customSessionExpiredErrorCode);
							HttpServletResponse resp = (HttpServletResponse) response;
							resp.sendError(this.customSessionExpiredErrorCode);
						}
						else
						{
							logger.info("Redirect to login page");
							throw ase;
						}
					}
					else
					{
						throw ase;
					}
				}
			}

		}
	}

	private static final class DefaultThrowableAnalyzer extends ThrowableAnalyzer
	{
		/**
		 * @see org.springframework.security.web.util.ThrowableAnalyzer#initExtractorMap()
		 */
		protected void initExtractorMap()
		{
			super.initExtractorMap();

			registerExtractor(ServletException.class, new ThrowableCauseExtractor()
			{
				public Throwable extractCause(Throwable throwable)
				{
					ThrowableAnalyzer.verifyThrowableHierarchy(throwable, ServletException.class);
					return ((ServletException) throwable).getRootCause();
				}
			});
		}

	}

	public void setCustomSessionExpiredErrorCode(int customSessionExpiredErrorCode)
	{
		this.customSessionExpiredErrorCode = customSessionExpiredErrorCode;
	}
}

This class is a copy of the org.springframework.security.web.access.ExceptionTranslationFilter class with some modifications to detect session timeout with Ajax-based request.

First we define 1 new attribute:

• customSessionExpiredErrorCode: custom HTTP error code to return for session timeout with Ajax-based request. The default value is 901

The main job is done at lines 46 & 48. We compare the request header “X-Requested-With“, when it exists, with the value “XMLHttpRequest” to detect whether the current request is Ajax-based or not. Please note that I did the test with IE 9 only, not sure it works for older IE version.

In most cases we simply re-throw the exception except when the call is Ajax-based. In this case we force an HTTP error code and completely bypass the remaining filters in the security filter chain.

 

3) Filter configuration

The idea is to add the above custom filter in the Spring Security filter chain. The order in the filter chain is crucial. Our filter should intercept the session timeout for Ajax calls before the vanilla ExceptionTranslationFilter in order to send the custom HTTP error code.

Configuration for Spring Security namespace users:

...
<beans:bean id="ajaxTimeoutRedirectFilter" class="doan.ajaxsessionexpiration.demo.security.AjaxTimeoutRedirectFilter">
	<beans:property name="customSessionExpiredErrorCode" value="901"/>
</beans:bean>
...
 <http auto-config="true" use-expressions="true">
        <intercept-url pattern="/**" access="isAuthenticated()" />
        <custom-filter ref="ajaxTimeoutRedirectFilter" after="EXCEPTION_TRANSLATION_FILTER"/>
	...
	...
</http>

Please notice that at line 10 we define our custom filter which is placed AFTER the EXCEPTION_TRANSLATION_FILTER in the chain. Being put later in the chain means that our filter can catch security exceptions before the EXCEPTION_TRANSLATION_FILTER which is what we want.

Configuration without Spring Security namespace:

...
<bean id="ajaxTimeoutRedirectFilter" class="doan.ajaxsessionexpiration.demo.security.AjaxTimeoutRedirectFilter">
	<property name="customSessionExpiredErrorCode" value="901"/>
	<property name="restString" value="/rest"/>
	<property name="restStringPatternMode" value="PREFIX"/>
</bean>
...
<bean id="securityFilterChain" class="org.springframework.security.web.FilterChainProxy">
	<sec:filter-chain-map request-matcher="ant">
	    <sec:filter-chain pattern="/**"  filters="
	           securityContextPersistentFilter,
	           logoutFilter,
	           authenticationProcessingFilter,
	           anonymousFilter,
	           exceptionTranslationFilter,
	           ajaxTimeoutRedirectFilter,
	           filterSecurityInterceptor
	           " />
  	</sec:filter-chain-map>
</bean>

B Other security frameworks

If you do not use Spring Security, there is a generic solution though. The idea is to add a special Http filter and check for HTTP session validity. If the session is no longer valid (timeout) and if the request is Ajax-base, you send a custom HTTP error as above.

First you should add a custom filter in the web.xml file:

...
<filter>
	<filter-name>ajaxSessionExpirationFilter</filter-name>
	<filter-class>doan.ajaxsessionexpiration.demo.security.AjaxSessionExpirationFilter</filter-class>
	<init-param>
		<param-name>customSessionExpiredErrorCode</param-name>
		<param-value>901</param-value>
	</init-param>
</filter>
...
<filter-mapping>
    	<filter-name>ajaxSessionExpirationFilter</filter-name>
    	<url-pattern>/*</url-pattern>
</filter-mapping>

Please note that this filter should be the one to kick in first (the first in the filter chain).

Then the implementation:

public class AjaxSessionExpirationFilter implements Filter
{

	private int customSessionExpiredErrorCode = 901;

    	@Override
	public void init(FilterConfig arg0) throws ServletException
	{
		// Property check here
	}

    	@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain filerChain) throws IOException, ServletException
	{
		HttpSession currentSession = ((HttpServletRequest)request).getSession(false);
		if(currentSession == null)
		{
			String ajaxHeader = ((HttpServletRequest) request).getHeader("X-Requested-With");
			if("XMLHttpRequest".equals(ajaxHeader))
			{
				logger.info("Ajax call detected, send {} error code", this.customSessionExpiredErrorCode);
				HttpServletResponse resp = (HttpServletResponse) response;
				resp.sendError(this.customSessionExpiredErrorCode);
			}
			else
			{
				// Redirect to login page
			}
		}
		else
		{
			// Redirect to login page
		}
	}
}

The session timeout detection is done at line 21. The getSession(false) method of the HttpServletRequest interface will return a HTTP session if one exists (and has not expired yet) but will not create a new one if no session exists or if the current session has expired.

The rest of the processing is similar to the Spring Security version.
 

C Client-side implementation

On the client side we should configure the Ajax callback function so it can handle properly our custom HTTP error code. For this jQuery comes to the rescue:

<script> 
function ajaxSessionTimeout()
{
	// Handle Ajax session timeout here
}

!function( $ )
{
	$.ajaxSetup({
		statusCode: 
		{
			901: ajaxSessionTimeout
		}
	});
}(window.jQuery);
</script>

We use the jQuery.ajaxSetup() function to define a custom behavior when an HTTP 901 status code is encountered. This is a mere callback to a function to handle Ajax request timout.

And that’s all !
 

III Demo application

I’ve created a demo application to illustrate this article. I set the session timeout to 1 minute.

On the main page, we have a popover element which trigger Ajax call to fetch user name from server.

After 1 minute the session expires, the Ajax error callback for Ajax session timeout is called. In this case I display a modal panel informing the user that his session has expired and prompting him to go back to login page to re-authenticate.