Servlet - Keep Session Alive for Active User and Auto Redirect To Login Page On Session Timeout

[Last Updated: Jun 27, 2018]

In the last example we saw how to forward to login page on session expiration. The problem with that approach is that the session might get expired on server while user is still actively working on the client. The client will only know about session timeout on making next server request.

Following example shows how to keep extending session timeout while user is still active on the client. We are going to use JQuery on the client to monitor user activity and to send Ajax requests to the server to extend the session. If user becomes idle for a certain time period (say 2 mins) then send logout request to the server and redirect to login page.



@WebServlet(name = "securedServlet", urlPatterns = {"/"})
public class MySecuredServlet extends HttpServlet {
  protected void doGet(HttpServletRequest req,
                       HttpServletResponse resp) throws ServletException, IOException {

      Principal principal = req.getUserPrincipal();
      if (principal == null || !req.isUserInRole("employee")) {
          LoginHandlerServlet.forwardToLogin(req, resp, null);

      req.setAttribute("user", req.getRemoteUser());
         .forward(req, resp);

  protected void doPost(HttpServletRequest req, HttpServletResponse resp)
          throws ServletException, IOException {
      doGet(req, resp);
@WebServlet(name = "loginServlet", urlPatterns = {"/loginHandler"})
public class LoginHandlerServlet extends HttpServlet {
  protected void doPost(HttpServletRequest req, HttpServletResponse resp)
          throws ServletException, IOException {

      String theUser = req.getParameter("theUser");
      String thePassword = req.getParameter("thePassword");
      try {
          req.login(theUser, thePassword);
      } catch (ServletException e) {
          forwardToLogin(req, resp, "Error: " + e.getMessage());
      boolean loggedIn = req.getUserPrincipal() != null && req.isUserInRole("employee");
      if (loggedIn) {
      } else {
          forwardToLogin(req, resp, "Login failed.");

  public static void forwardToLogin(HttpServletRequest req, HttpServletResponse resp,
                                    String errorMessage)
          throws ServletException, IOException {
      req.setAttribute("errorMsg", errorMessage);
         .forward(req, resp);
@WebServlet(name = "logoutServlet", urlPatterns = {"/logout"})
public class LogoutServlet extends HttpServlet {
  protected void doGet(HttpServletRequest req, HttpServletResponse resp)
          throws ServletException, IOException {
      System.out.println("logging out");
      Principal principal = req.getUserPrincipal();
      if (principal != null) {
          throw new RuntimeException("Cannot log out the user");

      HttpSession session = req.getSession(false);
      if (session != null) {
          //invalidate session specially if we have added some user specific info

      Object msg = req.getParameter("msg");
      if ("onTimeOut".equals(msg)) {
          LoginHandlerServlet.forwardToLogin(req, resp, "Session timeout.");

@WebServlet(name = "refreshServlet", urlPatterns = {"/refreshSession"})
public class RefreshSessionServlet extends HttpServlet {
  protected void doGet(HttpServletRequest req,
                       HttpServletResponse resp) {

      System.out.println("refreshing session");
          System.err.println("User logged out already, "
                  + "set higher setMaxInactiveInterval() ");
      HttpSession session = req.getSession();
      if (session == null) {
          System.err.println("cannot renew session");

Implementing HttpSessionListener

We are implementing HttpSessionListener to set a custom session timeout.

public class MySessionListener implements HttpSessionListener {
  public void sessionCreated(HttpSessionEvent se) {
      System.out.println("-- HttpSessionListener#sessionCreated invoked --");
      HttpSession session = se.getSession();
      System.out.println("session id: " + session.getId());
      session.setMaxInactiveInterval(120);//in seconds

  public void sessionDestroyed(HttpSessionEvent se) {
      System.out.println("-- HttpSessionListener#sessionDestroyed invoked --");

JSP pages


<div style="color:red">
     Object msg = request.getAttribute("errorMsg");
        if(msg != null ){
<form action="/loginHandler" method="post">
            <td> User:</td>
            <td><input type="text" name="theUser"/></td>
            <td> Password:</td>
            <td><input type="password" name="thePassword"/></td>
    <input type="submit" value="Submit"/>


 <script src=""></script>
    var lastActiveTime = new Date().getTime();
    $(document).ready(function() {
        $('body').bind('click mousemove keypress scroll resize', function() {
           lastActiveTime = new Date().getTime();
           setInterval(checkIdleTime, 30000); // 30 sec

     function checkIdleTime(){
     var diff = new Date().getTime() - lastActiveTime;
           if( diff > 120000){//2 min of inactivity
            window.location.href ="/logout?msg=onTimeOut"
               $.ajax({url: '/refreshSession', error: function(data, status, xhr){
                    alert("cannot refresh session on server: "+xhr);
<h2>Employee page</h2>
<div>User: <%= request.getAttribute("user")%> </div>
<a href='/logout'>Logout</a>

Adding tomcat-users.xml

Since we are using embedded tomcat for our demo, we are going to add tomcat-users.xml with authentication info:


<?xml version="1.0" encoding="UTF-8"?>
    <role rolename="employee"/>
    <user username="joe" password="123" roles="employee"/>

Specifying tomcat-user.xml location in pom.xml:



To try examples, run embedded tomcat (configured in pom.xml of example project below):

mvn tomcat7:run-war


Accessing http://localhost:8080/ and entering valid user name and password:

On submitting the form:

Session will be extending on the server side at 30 seconds rate given that user is active on the page. If user does not do anything (i.e. use mouse, key press, scrolling etc) for 2 mins then user will be logged out automatically and the page will be redirected to login page:

Example Project

Dependencies and Technologies Used:

  • javax.servlet-api 3.1.0 Java Servlet API
  • JDK 10
  • Maven 3.5.4

Servlet - Auto redirect using JQuery Select All Download
  • servlet-session-timeout-jquery-auto-logout
    • src
      • main
        • java
          • com
            • logicbig
              • example
        • webapp
          • config
          • employee-page.jsp

    See Also