title: How to deal with Http Session Timeout when using SSO
body: <p>I have a <strong>Spring application</strong> ( let's call it <strong>A</strong> for <strong>Authentication</strong>) used as an authentication server. 
  <strong>A</strong> is enabling <strong>SSO</strong> for two other applications ( <strong>B for Business and C for Client</strong>).</p>
  
  <p>SSO authentication is done by redirection : </p>
  
  <ul>
  <li>a User goes to the <strong>B</strong> or <strong>C</strong> URL, he is redirected to the A login page for Authentication. Once logged in, he is redirected back to the <strong>B</strong> or <strong>C</strong> application.</li>
  </ul>
  
  <p>The redirection is done using the <strong>redirectUrl</strong> parameter in the <code>org.springframework.security.web.savedrequest.SavedRequest</code>.</p>
  
  <p>So, a user can come either be coming from <strong>B</strong> or <strong>C</strong> application, or logging in directly to his account on the <strong>A</strong> application. </p>
  
  <p>My problem, is the following. Let's take the case of a user wants to connect to the <strong>B</strong> application, once he is redirected to the <strong>A</strong> application , he does not login.
  After a while a session timeout occurs, and the session is destroyed, so when he logs in, he is not redirected to the <strong>B</strong> application, but rather to his account on the <strong>A</strong> application.</p>
  
  <p>Possible solutions:</p>
  
  <ul>
  <li><p>The obvious way, is to disable timeout on the HttpSession :</p>
  
  <p><code>&lt;session-config&gt;
      &lt;session-timeout&gt;-1&lt;/session-timeout&gt;
  &lt;/session-config&gt;</code></p>
  
  <p>This is not a very good idea as it is a security risk, and a threat to overload the authentication server.</p></li>
  <li><p>I added a <code>HttpSessionDestroyedEvent</code>  ApplicationListener in order to detect a timeout and store the request of the session to be destroyed. The main idea was to redirect the user once he is connected after timeout. So on a successful connection, i check my  request cache in the <code>AuthenticationSuccessHandler</code> to see if a request is stored and redirect the user. </p>
  
  <pre><code>if (timeOutHandler.isTimeOut()) {
      redirectStrategy.sendRedirect(request, response, 
      timeOutHandler.getRequest().getRedirectUrl());
      timeOutHandler.clearSession();
      return;
   }
  </code></pre>
  
  <p>The problem with this approach is that I have no previous knowledge of the user who caused the timeout and I could end up in a scenario like this:  </p>
  
  <ul>
  <li>A user come from <strong>B</strong> application, causes a timeout. </li>
  <li>The request with redirect to <strong>B</strong> is stored.</li>
  <li>Another user comes from <strong>C</strong> application causes also a timeout.</li>
  <li>The request with redirect to <strong>B</strong> is overridden with the request to 
  redirect  to <strong>C</strong>.</li>
  <li>The first user tries to connect, he will be redirect to the application <strong>C</strong></li>
  </ul></li>
  </ul>
  
  <p>So, what do you think will be the best approach, or do you have a better solution? </p>
  
  <p>Thank you for your help.</p>