title: Ajax returns login page instead of error when session timeout
body: <p>I have a somewhat similar question as this <a href="https://stackoverflow.com/questions/3930646/session-timeout-response-in-ajax">one</a>, but I'll try to explain what is my understanding of what's happening and what ideas I came up with to fix it. Hopefully then someone wil be able to stir me on the right track.</p>
  
  <p><strong>The scenario:</strong> In my webapp, an authenticated user in a protected realm times out. He then performs an ajax call (using jquery), expecting json as a return value.</p>
  
  <p><strong>The config</strong>: The webserver is tomcat and here is the configuration code in web.xml:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;session-config&gt;
    &lt;session-timeout&gt;30&lt;/session-timeout&gt;
    &lt;tracking-mode&gt;COOKIE&lt;/tracking-mode&gt;
  &lt;/session-config&gt;
  ...
  &lt;login-config&gt;
    &lt;auth-method&gt;FORM&lt;/auth-method&gt;
    &lt;realm-name&gt;My Authentication Area&lt;/realm-name&gt;
    &lt;form-login-config&gt;
      &lt;form-login-page&gt;/login.jsp&lt;/form-login-page&gt;
      &lt;form-error-page&gt;/error.jsp&lt;/form-error-page&gt;
    &lt;/form-login-config&gt;
  &lt;/login-config&gt;
  </code></pre>
  
  <p><strong>What I understand</strong>: This tells the web server to de-authenticate users after 30 min of idleness, and to redirect unauthenticated users to login.jsp if they try to access a protected url.</p>
  
  <p><strong>What I would expect</strong>: The server returns an http error. The user is redirected to login.jsp.</p>
  
  <p><strong>What happens</strong>: The server returns login.jsp as an answer to the ajax call with answer code 200. Jquery then throws a parseerror because it cannot parse html to json. The user is left on the page, nothing seemed to have happened.</p>
  
  <p><strong>What I understand</strong>: The webserver never forwarded the request to the servlet because the session timed out and the url is in a protected realm. I shouldn't worry about servlet code.</p>
  
  <p><strong>What I would do</strong>: Using jQuery.ajaxError global event to intercept all parseerrors. While this would reduce boilerplate code it might not cover all cases. Also it is not acceptable if for some reason genuine json is returned with some broken syntax.</p>
  
  <pre class="lang-js prettyprint-override"><code>$(document).ajaxError(function(event, jqxhr, settings, exception){
     if (settings.dataType === 'json' &amp;&amp; exception.type === 'unexpected_token') {
        window.location.href = 'login.jsp';
     }
  })
  </code></pre>
  
  <p><strong>What I would like to do</strong>: Force tomcat to send an http error when responding to ajax and handle the redirection in the client. I do not know if tomcat can make the difference between a standard url request and an ajax request. </p>
  
  <p>I do not know what is the best approach to solve this problem, any help would be appreciated!</p>
  
  <p>Ren</p>