customized session timeout in spring/security

Question

How to customize session timeout in spring.. session timeout parameter/input is set in web.xml for 15 minutes.. and it is working fine.. I want to execute few lines before this session timeout happens and should be able to decide whether to proceed with session timeout or not.. This means.. I want to check some parameter in session and then want to selectively proceed with session timeout(i.e after 15 minutes of inactivity) for some users, and other users this timeout should never occur.

Answer 1

use HttpSessionListener

import javax.servlet.http.HttpSessionEvent;
import javax.servlet.http.HttpSessionListener;

public class SessionListener implements HttpSessionListener {

    @Override
    public void sessionCreated(HttpSessionEvent event) {
        // ..   event.getSession().getAttribute("xxxx")
        event.getSession().setMaxInactiveInterval(5*60);
    }

    @Override
    public void sessionDestroyed(HttpSessionEvent event) {
        System.out.println("==== Session is destroyed ====");
    }
}

register in web.xml

<web-app ...>
    <listener>
        <listener-class>yourpackage.SessionListener</listener-class>
    </listener>
</web-app>

or in your application initializer

public class AppInitializer implements WebApplicationInitializer {

//...
    @Override
    public void onStartup(ServletContext servletContext) throws ServletException {
        super.onStartup(servletContext);
        servletContext.addListener(new SessionListener());
    }
//...

}