title: How to customize Spring Security StandardSession.isValid() logic. Need max session time and skip request logic for IST
body: <p>I have a Java/Tomcat/Spring/Spring Security w/CAS application and I have two product requirements that I'm trying to figure out how to meet:</p>
  
  <ol>
  <li><p>The users HTTP/Authentication session must have a max timeout.  Only want the session valid for X amount of time, even if the user isn't idle.  I know how to change/set the idle timeout, but there doesn't appear to be support for a max session time.</p></li>
  <li><p>I need to be able to have certain requests not reset the idle timeout. Our GUI client polls the server frequently for updates and I want to exclude these requests from the idle session time out logic.</p></li>
  </ol>
  
  <p>I have looked through the Spring Security docs and source and I found Tomcat's implementation of the HttpSession, StandardSession.  In it is a call to isValid().  It looks like if I derived a new class from StandardSession I could could add my custom logic to the isValid() check for both Max Session time and idle session skip.  </p>
  
  <p>My question is, "Is this the correct way to add this custom logic?"  If so, then what I haven't been able to figure out is how to tell Tomcat to use my new Session object instead of it's own.  Is this even possible?  In Spring I would update my application config with a new bean then wire this bean in to the class that creates sessions. However, I don't know what the process is for the servlet files.</p>
  
  <p>I've seen may questions on both these two subjects but none of them are java, Tomcat, spring framework, spring security based.  I know if I wasn't using spring, or spring security then I'd have to implement a custom filter.  Since I'm using spring security I'd assumed that I need a spring security specific answer.</p>
  
  <p>My environment:
  SUSE 11 SP1 Linux</p>
  
  <p>Java v1.7</p>
  
  <p>Tomcat v7</p>
  
  <p>Spring Framework v3.2.2</p>
  
  <p>Spring Security v3.1.4</p>
  
  <p>Don't know if this matters but I'm doing CAS authentication but with the JAS-CAS client which means I've configured Spring Security to do pre-authenticated authentication.</p>