title: Session timeout upon refresh at login page
body: <p>I made a really simple <em>login and session</em> structure for reuse in my future JSP based applications. It's like this:</p>
  
  <p><strong>web.xml</strong> (the 1 minute timeout is to test my problem):</p>
  
  <pre><code>&lt;session-config&gt;
   &lt;session-timeout&gt;1&lt;/session-timeout&gt;
  &lt;/session-config&gt;
  
  &lt;filter&gt;
   &lt;filter-name&gt;Access&lt;/filter-name&gt;
   &lt;filter-class&gt;com.app.Access&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
   &lt;filter-name&gt;Access&lt;/filter-name&gt;
   &lt;url-pattern&gt;*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  &lt;servlet&gt;
   &lt;servlet-name&gt;Login&lt;/servlet-name&gt;
   &lt;servlet-class&gt;com.app.Login&lt;/servlet-class&gt;
  &lt;/servlet&gt;
  
  &lt;servlet-mapping&gt;
   &lt;servlet-name&gt;Login&lt;/servlet-name&gt;
   &lt;url-pattern&gt;/login&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  </code></pre>
  
  <p><strong>Access.java</strong> filter:</p>
  
  <pre><code>// Check if the page's the login or if the user logged, else asks login
  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws ServletException, IOException {
      HttpServletRequest httpRequest = (HttpServletRequest) request;
      boolean logged = httpRequest.getSession(false) != null &amp;&amp; httpRequest.getSession().getAttribute("user") != null;
      if (httpRequest.getServletPath().equals("/login") || logged)
          chain.doFilter(request, response);
      else
          ((HttpServletResponse) response).sendRedirect(httpRequest.getContextPath() + "/login");
  }
  </code></pre>
  
  <p><strong>Login.java</strong> servlet (authentication shortened for test):</p>
  
  <pre><code>protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
      if (request.getRequestedSessionId() != null &amp;&amp; !request.isRequestedSessionIdValid())
          request.setAttribute("failure", "session timeout");
      request.getSession().setAttribute("user", null);
      request.getRequestDispatcher("login.jsp").forward(request, response);
  }
  
  protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
      request.getSession().setAttribute("user", new User());
      response.sendRedirect("");
  }
  </code></pre>
  
  <p>And the <strong>login.jsp</strong> page, at the root of WebContent, has a <code>&lt;form action="login" method="post"&gt;</code> form with appropriated innerHTML for authentication and a <strong>${failure}</strong> field to receive a <em>session timeout</em> or a <em>login failed</em> message.</p>
  
  <p>This structure works perfectly for me. It intercepts, asks for login, checks both session and authentication, etc., but there's a small flaw: <strong>if you're at the login page and refresh it (either F5 or pressing Enter at the URL) after the timeout, the page receives and shows the "session timeout" message in ${failure}.</strong></p>
  
  <p>I found no real working way yet to make it know that the previous page was the login page. Tried about five different ways without success, including <code>request.getHeader("Referer")</code> and the <code>lastWish</code> tag library.</p>