Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SEC-2422: Session timeout not detected when enable CSRF protection #2642

Closed
spring-projects-issues opened this issue Dec 2, 2013 · 1 comment
Closed
Assignees
Labels
in: web type: bug type: jira
Milestone

Comments

@spring-projects-issues
Copy link

@spring-projects-issues spring-projects-issues commented Dec 2, 2013

Kazuki Shimizu (Migrated from SEC-2422) said:

settings is following:

    <sec:http auto-config="true" use-expressions="true">
        <sec:session-management 
            invalid-session-url="/error/sessionError"
            session-authentication-strategy-ref="sessionAuthenticationStrategy" />
    </sec:http>

Detected the session time-out when called GET method, but not detected session time-out when called POST method.
When called POST method, occurred the CSRF token error.

This behavior are best practice in the spring security?

Also When called POST method, i wanted to detect the session time-out.
If wanted to detect the session timeout when called POST method, what should I do?

@spring-projects-issues
Copy link
Author

@spring-projects-issues spring-projects-issues commented Dec 11, 2013

Rob Winch said:

Thanks for the report. This is now resolved in master and will be part of 3.2 release.

@spring-projects-issues spring-projects-issues added in: web Closed type: bug type: jira labels Feb 5, 2016
@spring-projects-issues spring-projects-issues added this to the 3.2.0 milestone Feb 5, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: web type: bug type: jira
Projects
None yet
Development

No branches or pull requests

2 participants