title: How to prevent http session to expire while WebSocket is open
body: <p>I have a web application which is secured through <code>Spring Security</code>.</p>
  
  <p>The application creates a <code>WebSocket</code> and pushes notification messages to the clients.</p>
  
  <p>However, since sometimes there are no page reloads for a long time, but only <code>WebSocket</code> messages, the <code>HTTP session</code> expires and the <code>WebSocket</code> gets closed.</p>
  
  <p>Is there a way to make <code>Spring Security</code> keep the session alive as long as a <code>WebSocket</code> is connected, even no HTTP requests come in?</p>
  
  <p>Here is my <code>Spring Security</code> configuration:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http
      .csrf().disable()
      .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
      .and()
      .authorizeRequests()
      .anyRequest()
      .access("hasAnyRole('ROLE_ADMIN') or hasIpAddress('127.0.0.1/32') or hasIpAddress('192.168.0.0/24') or hasIpAddress('192.168.1.0/24')")
      .and()
      .formLogin().loginPage("/login")
      .loginProcessingUrl("/checklogin")
      .usernameParameter("user")
      .passwordParameter("pass")
      .defaultSuccessUrl("/", true)
      .failureUrl("/login?failed=true")
      .permitAll()
      .and()
      .logout()
      .logoutUrl("/logout")
      .logoutSuccessUrl("/login")
      .deleteCookies("JSESSIONID")
      .invalidateHttpSession(true)
      .permitAll();
  }
  </code></pre>
  
  <p>When I am not in any of the allowed networks, I get the login-form. Once logged in with <code>ROLE_ADMIN</code> I stop getting <code>WebSocket</code> messages afer a while. When I then refresh the page, I am redirected to the login mask, so most probably the session is expired... :-)</p>