title: Spring Session & Spring Security - session timeout handling not working
body: <p>When attempting to add spring-session to an existing Spring MVC project with spring-security, I get the following behavior (EDIT: with tomcat's session-timeout set to 1 minute for testing):</p>
  
  <ul>
  <li>With the springSessionRepositoryFilter filter in web.xml <em>commented-out</em>, I am correctly booted to the login screen after a minute of inactivity</li>
  <li>With the springSessionRepositoryFilter filter in web.xml active, I can continue to use the app at least 5 minutes after the last activity</li>
  </ul>
  
  <p>Besides that, everything seems to work as expected - the session is persisted in redis &amp; across webapp restarts, and logging out manually correctly invalidates the session. </p>
  
  <p>Some snippets of my configuration - here is the invalid session handler configuration for spring-security, that will cause expired sessions to be redirected to a login page:</p>
  
  <pre class="lang-xml prettyprint-override"><code>...
  &lt;beans:bean id="sessionManagementFilter" class="org.springframework.security.web.session.SessionManagementFilter"&gt;
      &lt;beans:constructor-arg name="securityContextRepository"&gt;
          &lt;beans:bean class="org.springframework.security.web.context.HttpSessionSecurityContextRepository"/&gt;
      &lt;/beans:constructor-arg&gt;
      &lt;beans:property name="invalidSessionStrategy"&gt;
          &lt;beans:bean class="my.CustomInvalidSessionStrategy"/&gt;
      &lt;/beans:property&gt;
  &lt;/beans:bean&gt;
  ...
  &lt;http&gt;
      ...
      &lt;custom-filter position="SESSION_MANAGEMENT_FILTER" ref="sessionManagementFilter"/&gt;
      ...
      &lt;logout delete-cookies="true" invalidate-session="true" logout-url="/signout.html" success-handler-ref="logoutSuccessHandler"/&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>The web.xml 's filter chain looks like:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;filter&gt;
      &lt;filter-name&gt;springSessionRepositoryFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSessionRepositoryFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>And (one of) the spring context files loaded contains:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;bean class="org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration"/&gt;
  
  &lt;bean class="org.springframework.security.web.session.HttpSessionEventPublisher"/&gt;
  
  &lt;bean class="org.springframework.data.redis.connection.jedis.JedisConnectionFactory"/&gt;
  </code></pre>
  
  <p>Hopefully I'm just missing something really obvious!</p>
  
  <p>Edit: The versions I used for the attempt was <strong>spring-security-4.0.4.RELEASE</strong> and <strong>spring-session-1.1.1.RELEASE</strong></p>