Session Timeout with jsp

[Vivek]

Hi all,

I have a jsp which is called when a session times out wherein I use
session.invalidate() method to invalidate the session and display a
message to the user to login again as his session has expired.

Now the problem is that we don't have a separate login page to login
the application. We just use the authentication window provided by the
browser to login to the application. So, when the user clicks on the
link to the application home page from the session-timedout page, he
should ideally be asked his username/password but that's not happening
even though his previous session has been invalidated.

I am really confused to what I can do to make this work. I also tried
to open the application link in a new window both with the browser
right-click and also through javascript window.open but that also takes
the username/pwd from the old request and logs in the application
without showing any authentication window.

Any help will be appreciated.

Thanks,
Vivek Jani

 

[Oscar kind]

I have a jsp which is called when a session times out wherein I use
session.invalidate() method to invalidate the session and display a
message to the user to login again as his session has expired.

Now the problem is that we don't have a separate login page to login
the application. We just use the authentication window provided by the
browser to login to the application. So, when the user clicks on the
link to the application home page from the session-timedout page, he
should ideally be asked his username/password but that's not happening
even though his previous session has been invalidated.

Correct: the browser caches the credentials, and automatically uses them.
IFAIK, there is no way to stop this. You can only restart the browser.

I am really confused to what I can do to make this work. I also tried
to open the application link in a new window both with the browser
right-click and also through javascript window.open but that also takes
the username/pwd from the old request and logs in the application
without showing any authentication window.

Because the browser caches the credentials and that cache cannot be
emptied (easily), you need to exit/terminate the browser application and
start it again.

Alternatively, you can use form authentication, but that means writing a
separate login page.