how to validate the session in spring mvc interceptor

Question

I am newbie to spring framework.In my code,i use the interceptor for checking the session exists or not.If session exists i allow to call the controller otherwise i redirect the login page. Below is my code.

@Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response,



        Users user=(Users) session.getAttribute("user");
        if(user == null)
        {
            System.err.println("Request Path : ");
            response.sendRedirect("index");
            return false;
        }
        else
        {
            return true;
        }
    }

but this code not redirect successfully.I am getting the below error,

In Mozilla i get below error
    The page is not redirecting properly
In chorme i get below error?
    This web page has redirect loop

How to fix this issue?Any help will be greatly appreciated!!!

Answer 1

Just a wild guess, because you forgot to say how your interceptor is configured. I think it could be caused by the interceptor being applied to the login page index.

If this is true any page will ask the browser to redirect to index page, but index page itself will send a redirect request to browser.

The correct way is to configure the interceptor to ignore the login page

@Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response,

        // ignore login page
        if (request.getServletPath() == "/index") { // BEWARE : to be adapted to your actual login page
            return true;
        }

        Users user=(Users) session.getAttribute("user");
        if(user == null)
        {
            System.err.println("Request Path : ");
            response.sendRedirect("index");
            return false;
        }
        else
        {
            return true;
        }
    }

You could also use SpringMVC configuration to have the interceptor not applied to the login page

But anyway, if you want to build a serious application, my advice is to have a look to Spring Security that nicely integrates in a Spring MVC application and comes with a bunch of examples to avoid above problem (and others ...)