Message Boards

  1. Home
  2. Development
  3. Liferay 7.1 redirect on session timeout

Liferay 7.1 redirect on session timeout

Federico Aleotti, modified 4 Years ago.

Liferay 7.1 redirect on session timeout

New Member Posts: 11 Join Date: 8/20/19 Recent Posts
Hi everybody,I'm working on a Liferay 7.1 portal that integrates Shibboleth and I have to manage session expiration both on Liferay and Shibboleth. I'm trying to set Liferay session timeout shorter than Shibboleth session timeout and on Liferay session expiration redirecting on Shibboleth logout URL.I've set portal-ext and web.xml in order to  configure Liferay session timeout, but the only way I found to execute the redirect on session timeout was by changing session_timeout.jspf located in ROOT/html/common/themes. I'm quite sure it is a bad practice, but I can't figure out which os the best way to archive redirection on session timeout on a specific page.I've tried session.timeout.redirectUrl in portal-ext, but it doesn't work and I can't use company.default.home.url because I must redirect on a specific page, not the home URL.Thank you for any advice and suggestion.
thumbnail
Olaf Kock, modified 4 Years ago.

RE: Liferay 7.1 redirect on session timeout

Liferay Legend Posts: 6403 Join Date: 9/23/08 Recent Posts
Federico Aleotti:

the only way I found to execute the redirect on session timeout was by changing session_timeout.jspf located in ROOT/html/common/themes. I'm quite sure it is a bad practice, but ...
session_timeout.jspf specifies the URL to redirect to
redirectUrl: '<%= HtmlUtil.escapeJS(SSOUtil.getSessionExpirationRedirectURL(themeDisplay.getCompanyId(), themeDisplay.getURLHome())) %>',
so, if you don't like that location, it's what you need to override. Now, you can also insert some snippet just like the one you find in this file into your own theme, and make it remove Liferay's end-of-session-handler, then insert your own one. That's your choice - and I feel that an override in the theme is easier to maintain, as it's completely "in addition" to what Liferay has, and not a code-change to maintain in future versions.
Federico Aleotti, modified 4 Years ago.

RE: Liferay 7.1 redirect on session timeout

New Member Posts: 11 Join Date: 8/20/19 Recent Posts
Thank you for the response. So, if i get it right, modifying session_timeout.jspf is not a bad practice, but as intended. 
thumbnail
Olaf Kock, modified 4 Years ago.

RE: Liferay 7.1 redirect on session timeout

Liferay Legend Posts: 6403 Join Date: 9/23/08 Recent Posts
Federico Aleotti:

Thank you for the response. So, if i get it right, modifying session_timeout.jspf is not a bad practice, but as intended. 
Modifying core files is never best practice - but in this case it's either this, or adding another one that undoes what session_timeout.jspf does, then re-does it the way you'd like it to work.
This particular one, I consider low-impact, thus I have no hard feelings to violently argue against it. I haven't looked into 7.x ext-mechanics, but ideally I'd make a change to a core file through an ext plugin (instead of documenting which file to manually change). Again - as much as I argue against ext, here we have a low-impact and low-cost change. The file is very small, and future changes to it will be limited, as it has exactly one job and zero complexity. Thus maintenance effort will be low if you choose to modify this file and then apply a patch or the next major upgrade.