title: Spring security invalid session redirect
body: <p>I'm using spring security 4.0.1 inside a spring boot 1.2.3 web application ( and also with spring-session 1.0.1, but this is irrelevant for the case ).</p>
  
  <p>I do have a private area, and an all access area ( "/about", "/","/contact",... more than 20 pages ) for which every user can access.  ( it's like a web-shop )</p>
  
  <p>Whenever a <strong>logged-in</strong> user session expires,Spring detects an invalid session and redirects the user to the <strong>'.invalidSessionUrl("/session/error/invalid")'</strong></p>
  
  <p>However, i only want to be redirected if the target link in inside the private area, nor the public one.</p>
  
  <p>How can i avoid that ?</p>
  
  <p>Thanks.</p>
  
  <p>This is my (java) config : ( <strong>updated</strong> after seen post )</p>
  
  <pre><code> http
              .authorizeRequests()
              .anyRequest()
                  .permitAll()
              .antMatchers("/privado/**")
                  .authenticated()
              .and()
                  .formLogin()
                  .loginPage("/login")
                  .failureUrl("/login?error")
                  .defaultSuccessUrl("/")
                  .successHandler(new SessionSuccessHandler())
              .and()
                  .logout()
                  .logoutSuccessUrl("/")
                  .deleteCookies("JSESSIONID", "SESSION")
              .and()
                  .sessionManagement()
                  .invalidSessionUrl("/session/error/invalid")
              .sessionFixation()
              .changeSessionId()
              .maximumSessions(1)
              .expiredUrl("/session/error/expired")
              .and()
              .and()
                  .csrf()
                  .ignoringAntMatchers("/jolokia/**", "/v1.0/**");
  </code></pre>
  
  <p>How can i achieve that ?</p>
  
  <p>Thanks a lot.</p>