Disable SpringSecurity's SavedRequest storing logic

Question

We are using Spring Security for managing authentication. The issue we are seeing is that when a user's session is timed out between bringing up a GET form and hitting the save button that does a POST, they are sent to the login page but spring is saving the original post information in the session.

Our app does not bring them back to the original URL after login, but instead sends them back to a common starting page. This works fine, but when the user happens to return to the page they had originally tried to POST to (the form GET and POST are the same URLs) Spring tries to resubmit the POST automatically which is not what we want.

Is there a way to completely disable the SavedRequest storing logic in Spring?

Answer 1

I guess this jira issue of spring security describes your problem and how to handle this.

Answer 2

Based on Nathan's comment on Raghuram's answer, with namespaced XML it's something like this:

<security:http>
    <security:request-cache ref="nullRequestCache" />
    <!-- ... -->
</security:http>

<bean id="nullRequestCache" class="org.springframework.security.web.savedrequest.NullRequestCache" />

Answer 3

There are two scenarios: 1) If you want that after relogin, user should always get forwarded to the default target URL instead of the orginal requested URL then put always-use-default-target="true" in your security.xml like

<http auto-config="true"> 
.....
<form-login login-page="/login" always-use-default-target="true" default-target-url="/xyz" 
        authentication-failure-url="/login?error=true" login-processing-url="/j_security_check"/>
</http>

1) If you want that on session timeout after relogin, user should forward to the orginal requested URL but you do not want to resubmit the form then put session-fixation-protection="newSession" in your security.xml like

<http auto-config="true">
<session-management session-fixation-protection="newSession"/> 
.....
</http>

Please put session-management tag as first line in http configuration.