How to log when jwt expired in spring boot - spring

Question

I want to log user when logged-in and logged-out, and in also when jwt token expired. To do this requirement i call loginHistoryService.saveUserLogout() when ExpiredJwtException occurs, but the problem is that this method called more than one, because the when user opens the form, this form contains a lots of ajax requests, so each request cause to go to this filter and log user logout multiple times.
Is there a better way to implement this requirement?
public class JWTAuthorizationFilter extends OncePerRequestFilter {
#Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
if (!request.getRequestURI().contains("/signout")) {
try {
if (checkJWTToken(request)) {
Claims claims = validateToken(request);
if (claims.get(CLAIM_AUTHORITIES_KEY) != null) {
setUpSpringAuthentication(claims);
}
else {
SecurityContextHolder.clearContext();
}
}
else {
SecurityContextHolder.clearContext();
}
chain.doFilter(request, response);
} catch (ExpiredJwtException e) {
// call log method here, but this method called more than one
loginHistoryService.saveUserLogout();
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
response.setHeader("ExpiredJwt", "true");
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Your JWT token expired!");
} catch (UnsupportedJwtException | MalformedJwtException e) {
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "forbidden!");
}
}
else {
chain.doFilter(request, response);
}
}
}
UPDATE 1
The purpose of loginHistoryService is store LoginHistory object with below declaration:
#Entity
#Table(name = "tbl_login_history")
public class LoginHistory extends BaseEntity<Long> {
#Column(name = "user_name", nullable = false)
private String userName;
#ManyToOne(fetch = FetchType.LAZY)
#JoinColumn(name = "user_id")
private User user;
#Column(name = "is_success", nullable = false)
private boolean success;
#Column(name = "is_login", nullable = false)
private boolean login;
#Column(name = "browser_type")
private BrowserType browserType;
#Column(name = "browser_name")
private String browserName;
#Column(name = "operating_system_type")
private OperatingSystemType operatingSystemType;
#Column(name = "operating_system_name")
private String operatingSystemName;
#Column(name = "login_failure_reason")
private LoginFailureReason loginFailureReason;
}
That audits user logins and logouts.
UPDATE 2
I changed LoginHistory and added jwtToken field to store jwt and check if a record exists, then do not insert. but the problem is that it the records inserted multiple time.
#Service
public class LoginHistoryService implements ILoginHistoryService {
#Autowired
private ILoginHistoryRepository loginHistoryRepository;
#Override
#Transactional
public void saveLogWhenExpiredUser(String token) {
if (!loginHistoryRepository.checkExpiredTokenExistence(token)) {
// save the log record
}
}
}
And this is the method that checks record existence:
#Override
public boolean checkExpiredTokenExistence(String token) {
String hql = " select cast((case when count(*) = 0 then 0 else 1 end) as boolean) " +
" from " + domainClass.getName() + " e " +
" where e.jwtToken = :jwtToken " +
" and e.logoutType = :logoutType " ;
Map<String, Object> params = new HashMap<>();
params.put("jwtToken", token.getBytes());
params.put("logoutType", LogOutType.Expired);
return super.find(hql, params);
}

Answer 1

because the when user opens the form, this form contains a lots of
assets and ajax requests, so each request cause to go to this filter
and log user logout multiple times
Your public assets must not be taken into account by your security filter. Kindly ignore security check on your public assets

Answer 2

Just add a constraint on uniqueness of jwtToken and logoutType:
#Entity
#Table(uniqueConstraints={
#UniqueConstraint(columnNames = {"jwtToken", "logoutType"})
}, name = "tbl_login_history")
public class LoginHistory extends BaseEntity<Long> {
...
}