refresh cookie on each request in spring - spring

Question

I have an application in which I have set the session timeout to be 1 hour. But I do not want that if the user closes his browser and opens it again, he has to login again. For that I need a method to somehow refresh cookie expiry time on each request.
I am using spring boot with spring security. How can I achieve this functionality.?

Answer 1

I have solved it using Interceptor. The idea is to intercept http request and modify the jsessionid cookie and set expiry time to whatever value you want. This would allow the cookie to be reused by the browser once it is re-opened. By default jsessionid cookie has max age equal to -1 which means that it cookie would expire as soon as browser is closed.
public class CookieExpiryRefresher extends HandlerInterceptorAdapter {
#Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, //
Object handler, ModelAndView modelAndView) throws Exception {
Cookie[] cookies = request.getCookies();
for (Cookie cookie : cookies){
if (cookie.getName().contentEquals("JSESSIONID")){
if (cookie.getValue().contentEquals(request.getSession().getId())){
cookie.setMaxAge(60*60*5);
cookie.setPath("/");
response.addCookie(cookie);
break;
}
}
}
}
}
And this interceptor can be registered as follows:
#Component
public class WebMvcConfig extends WebMvcConfigurerAdapter{
#Override
public void addInterceptors(InterceptorRegistry registry){
registry.addInterceptor(new CookieExpiryRefresher());
}
}

Answer 2

Baeldung has a solution for this using Filter. # https://www.baeldung.com/spring-security-session
public class SessionFilter implements Filter {
#Override
public void doFilter(
ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse res = (HttpServletResponse) response;
Cookie[] allCookies = req.getCookies();
if (allCookies != null) {
Cookie session =
Arrays.stream(allCookies).filter(x -> x.getName().equals("JSESSIONID"))
.findFirst().orElse(null);
if (session != null) {
session.setHttpOnly(true);
session.setSecure(true);
res.addCookie(session);
}
}
chain.doFilter(req, res);
}
}

Answer 3

You can create, update and delete cookie only in preHandle of interceptor.
If you want to add a cookie after the controller get called, then one have to use ControllerAdvice
#ControllerAdvice
public class CookieAdvice implements ResponseBodyAdvice<Object> {
#Override
public boolean supports(MethodParameter returnType,
Class<? extends HttpMessageConverter<?>> converterType) {
return true;
}
#Override
public Object beforeBodyWrite(Object body, MethodParameter returnType,
MediaType selectedContentType,
Class<? extends HttpMessageConverter<?>> selectedConverterType,
ServerHttpRequest request, ServerHttpResponse response) {
Cookie cookie = new Cookie("cookieName", cookieValue);
ServletServerHttpResponse resp = (ServletServerHttpResponse)response;
resp.getServletResponse().addCookie(cookie);
return body;
}
}