Real-time Session Expiration Notification using WebSockets

In web applications, managing user sessions and their expiration is crucial for security and user experience. Traditionally, session expiration is handled on the backend, with the frontend only discovering it on a subsequent HTTP request, often leading to a subpar user experience or lost work. This article presents an architectural approach to proactively inform the client about session expiration using WebSockets.

Architectural Shift: From Polling to Push Notifications

The core problem addressed is the reactive nature of HTTP-based session management. When an HTTP session expires, the client typically doesn't know until it attempts another request, which then gets redirected or denied. This creates a delay in feedback to the user. By integrating WebSockets, the backend can push an immediate notification to the client upon session destruction, enabling real-time UI updates or actions like forcing a login redirect.

Implementing Real-time Session Expiration with WebSockets

The article demonstrates a practical implementation using Spring Boot, Spring Security, and Spring WebSocket. Key components include:

• A custom `HttpSessionListener` on the server-side to detect session destruction events.
• An `HttpSessionEventPublisher` to bridge servlet events to Spring's application context.
• A WebSocket endpoint (e.g., via STOMP and SockJS) that the server uses to send messages to the client when a session is destroyed.
• Client-side JavaScript to establish a WebSocket connection and handle incoming session expiration messages, triggering UI actions like page reload to enforce re-authentication.

@Component
public record CustomHttpSessionListener() implements HttpSessionListener {
    private static final Logger log = LoggerFactory.getLogger(CustomHttpSessionListener.class);

    @Override
    public void sessionCreated(HttpSessionEvent event) {
        log.info("Session (ID: {}) created.", event.getSession().getId());
    }

    @Override
    public void sessionDestroyed(HttpSessionEvent event) {
        log.info("Session (ID: {}) destroyed.", event.getSession().getId());
        // Here, integrate WebSocket logic to notify the client
        // e.g., send a message to a specific user's WebSocket session
    }
}

This setup allows for a proactive approach, where the server, immediately upon detecting a session expiration (e.g., due to inactivity timeout), sends a message via the established WebSocket connection to the relevant client. This enables the client-side application to react instantly, for example, by displaying a "Session Expired" message, clearing local state, or redirecting to the login page, thus providing a smoother user experience compared to waiting for the next API call to fail.