title: How to handle session timeout in Spring-security 3.2
body: <p>I am new to spring security. I am trying to redirect the URL to login page on clicking any tab/link after session time out</p>
  
  <p>I have below configuration in my security context </p>
  
  <pre><code>&lt;global-method-security pre-post-annotations="enabled"
      secured-annotations="enabled"&gt;
      &lt;!-- &lt;expression-handler ref="expressionHandler"/&gt; --&gt;
  &lt;/global-method-security&gt;
  
  &lt;security:http pattern="/pages/common/UnAuthorized.html*"
      security="none" /&gt;
  &lt;security:http pattern="/resources/images/*" security="none" /&gt;
  &lt;security:http pattern="/Logout.html*"
      security="none" /&gt;
  &lt;security:http pattern="/SessionTimeout.html*"
      security="none" /&gt;
  
  &lt;security:http auto-config="false" use-expressions="true"
      entry-point-ref="http403EntryPoint"&gt;
      &lt;security:intercept-url pattern="/**"
          access="fullyAuthenticated" /&gt;
      &lt;security:custom-filter position="PRE_AUTH_FILTER"
          ref="siteminderFilter" /&gt;
      &lt;security:logout delete-cookies="JSESSIONID,SMSESSION"
          invalidate-session="true" logout-url="/logout" logout-success-url="/Logout.html" /&gt;
      &lt;security:session-management
          invalid-session-url="/SessionTimeout.html"&gt;
           &lt;security:concurrency-control expired-url="/pages/common/SessionTimeout.html" /&gt;
      &lt;/security:session-management&gt;
  &lt;/security:http&gt;
  
  &lt;security:authentication-manager alias="authenticationManager"&gt;
      &lt;security:authentication-provider
          ref="customAuthenticationProvider"&gt;
      &lt;/security:authentication-provider&gt;
  &lt;/security:authentication-manager&gt;
  
  &lt;beans:bean id="sessionRegistry"
      class="org.springframework.security.core.session.SessionRegistryImpl" /&gt;
  &lt;beans:bean id="http403EntryPoint"
      class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" /&gt;
  </code></pre>
  
  <p>And registered an event in web.xml along with session-timeout configuration</p>
  
  <pre><code>&lt;session-config&gt;
      &lt;session-timeout&gt;2&lt;/session-timeout&gt;
      &lt;cookie-config&gt;
          &lt;http-only&gt;true&lt;/http-only&gt;
          &lt;secure&gt;true&lt;/secure&gt;
      &lt;/cookie-config&gt;
      &lt;tracking-mode&gt;COOKIE&lt;/tracking-mode&gt;
  &lt;/session-config&gt;
  
  &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.security.web.session.HttpSessionEventPublisher&lt;/listener-class&gt;
  &lt;/listener&gt;
  &lt;filter&gt;
      &lt;filter-name&gt;localDeploymentFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
   &lt;filter&gt;
   &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
  &lt;filter-class&gt;
                org.springframework.web.filter.DelegatingFilterProxy
  &lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;servlet&gt;
   &lt;servlet-name&gt;spring-dispatcher&lt;/servlet-name&gt;
    &lt;servlet-class&gt;
          org.springframework.web.servlet.DispatcherServlet
      &lt;/servlet-class&gt;
    &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  </code></pre>
  
  <p>I am not sure in what I am missing here. But the url is not getting redirected to the sessiontimeout page. </p>
  
  <p>When I tried to debug the springs code, I saw that only "RegisterSessionAuthenticationStrategy" is getting called and the new session are getting created using the existing session. I am expecting some code which will redirect to the session expiry URL. But I didnt find any during the debug. </p>