Spring Boot exclude URL to prevent maitaining the session timeout

Viewed 572

I've got Spring Boot based server side application with Frontend build in Angular. After user login, on frontend side I have scheduled method which sends request to backend to refresh the data in table. It's sent every 10 seconds. I do not want those request to constantly extend session, but I still wish to keep this request available for only authorized users. I've tried to it this way:

@Component
@Order(Integer.MIN_VALUE)
class ExcludeSessionRepositoryFilter : OncePerRequestFilter() {

private val filteredURLs = listOf(
    "/xxx",
    "/yyy"
)

override fun doFilterInternal(
    request: HttpServletRequest,
    response: HttpServletResponse,
    filterChain: FilterChain
) {
    if (filteredURLs.contains(request.requestURI)) {
        request.setAttribute("org.springframework.session.web.http.SessionRepositoryFilter.FILTERED", true)
    }
    filterChain.doFilter(request, response)
    }
}

It's comming to the if, but it didn't work at all. Next I've tried to change Security Config based on one of the asnwers here like this:

 http.csrf()
            .ignoringAntMatchers(""/login","/xxx","/yyy")

But it didn't work either. For tests, I have set the session timeout in properties like this:

server:
  servlet:
    session:
      timeout: 1m

But even after couple of minutes I still have the session because of those request comming in from frontend after each 10 seconds.

Versions:

 org.springframework.boot:2.4.0
 org.springframework.boot:spring-boot-starter-security:2.+
0 Answers
Related