title: Spring security + Ajax session timeout issue
body: <p>I have an app build with Spring MVC and secured with Spring security, a bunch of the controllers are JSON rest services that are all protected.  I'm using <code>LoginUrlAuthenticationEntryPoint</code> to detect AJAX requests and send <code>403 </code> ERROR CODE if session timeout occurs - all other requests just get redirected back to login page.</p>
  
  <p>Below is the Spring Security XML snippet and the authenticationEntryPoint java class.</p>
  
  <p>The issue is that the first AJAX Request after session timeout, Spring redirects to login page and the returns login page HTML, if I attempt to do AJAX request again (after redirect happens) the authenticationEntryPoint executes and HTTP Error Code 403 is returned.  I have attempted the same thing using this mechanism <a href="http://distigme.wordpress.com/2012/11/01/ajax-and-spring-security-form-based-login/" rel="noreferrer">http://distigme.wordpress.com/2012/11/01/ajax-and-spring-security-form-based-login/</a> and the same exact thing happens (on first AJAX request a redirect occurs, all subsequent AJAX requests HTTP 403 is returned).  I do not want to get Redirect to login page for AJAX requests where session is timed out.</p>
  
  <p>Any ideas?</p>
  
  <pre><code>&lt;beans:bean id="authenticationEntryPoint"  class="mojo.ocs.web.AjaxAwareAuthenticationEntryPoint"&gt;
      &lt;beans:constructor-arg name="loginUrl" value="/login"/&gt;
  &lt;/beans:bean&gt;
  &lt;!-- ENTRY POINT REF IMPLEMENTATION --&gt;
  &lt;http auto-config="true" use-expressions="true" access-denied-page="/accessdenied" entry-point-ref="authenticationEntryPoint"&gt;
      &lt;intercept-url pattern="/login" access="isAnonymous()"/&gt;
      &lt;intercept-url pattern="/loginfailed" access="isAnonymous()"/&gt;
      &lt;intercept-url pattern="/welcome" access="isAuthenticated()" /&gt;
      &lt;intercept-url pattern="/" access="isAuthenticated()" /&gt;
      &lt;intercept-url pattern="/private_res/**" access="isAuthenticated()" /&gt;
      &lt;intercept-url pattern="/tne/**" access="isAuthenticated()" /&gt;
      &lt;intercept-url pattern="/team_reports/**" access="isAuthenticated()" /&gt;
      &lt;form-login login-page="/login" default-target-url="/welcome" always-use-default-target="true" authentication-failure-url="/loginfailed" /&gt;
      &lt;logout delete-cookies="JSESSIONID"  logout-success-url="/logout" invalidate-session="true"/&gt;
      &lt;session-management invalid-session-url="/login" /&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>Here is the LoginAuthenticationEntryPoint:</p>
  
  <pre><code>public class AjaxAwareAuthenticationEntryPoint extends LoginUrlAuthenticationEntryPoint     
  {
      public AjaxAwareAuthenticationEntryPoint(String loginUrl) {
          super(loginUrl);
      }
  
      @Override
      public void commence(
          HttpServletRequest request,
          HttpServletResponse response,
          AuthenticationException authException)
          throws IOException, ServletException {
          String ajaxHeader = ((HttpServletRequest) request).getHeader("X-Requested-With");
          boolean isAjax = "XMLHttpRequest".equals(ajaxHeader);
          if (isAjax) {
              response.sendError(HttpServletResponse.SC_FORBIDDEN, "Ajax REquest Denied (Session Expired)");
          } else {
              super.commence(request, response, authException);
          }
      }
  }
  </code></pre>