Handling DWR Session timeouts

I recently had an issue in an application using Acegi and DWR, where even after the session invalidation the DWR calls could still be made. It seemed DWR calls were ignoring session timeouts. In order to over come this issue I wrote a little Ajax filter to check for session invalidation for DWR calls and throw an Exception if session has timed out. Throwing exception is more of a natural way of handling such scenarios then sending “plain/text” messages as recommended in DWR 2 API.

package myApp;

import java.lang.reflect.Method;
import org.directwebremoting.AjaxFilter;
import org.directwebremoting.AjaxFilterChain;
import org.directwebremoting.WebContextFactory;
import org.directwebremoting.extend.LoginRequiredException;

public class DwrSessionFilter implements AjaxFilter {
 public Object doFilter(Object obj, Method method, Object[] params, AjaxFilterChain chain) throws Exception {

  //Check if session has timedout/invalidated
  if (WebContextFactory.get().getSession(false) == null) {
   //Throw an exception
   throw new LoginRequiredException("This operation requires login.");
  }

  return chain.doFilter(obj, method, params);
 }
}

Then attach this filter with DWR bean:

In version 3.0RC-2 or later it is possible to have a global filter (<dwr:global-filter>) that can be used by all DWR beans.

Now after this all you need to do is catch the thrown LoginRequiredException on the client side.

dwr.engine.setErrorHandler(errorHandler);

function errorHandler(message, exception) {
 //Session timedout/invalidated
 if (exception.javaClassName == 'org.directwebremoting.extend.LoginRequiredException') {
  //Reload or display an error etc.
  document.location.reload();
 }
}

Here reloading the page was helpful because we were using Acegi (now known as spring security) and we had the FilterSecurityInterceptor setup to take care of the request. DWR guys also recommend something similar but that requires reverse Ajax and it also is not a natural way of handling this.

In Acegi it is also possible to have method-level role-based authorization for DWR calls using the MethodSecurityInterceptor. I will try to explain that in the next blog entry.