title: How to handle Form-Based Authentication login (j_security_check) after session-timeout
body: <p>a question regarding the handling of login to a web/application server (WildFly 9.0.2) after a session-timeout.</p>
  
  <p>Scenario:</p>
  
  <p>I have a simple Web Application with a login page using Form-Based Authentication (action: j_security_check) and container managed login.</p>
  
  <p>This works as expected:</p>
  
  <ol>
  <li>Login works as follows:</li>
  <li>Invoking in Browser the URL localhost:8080/SecurityWeb/ </li>
  <li>Then the login page is shown in Browser.</li>
  <li>Then login to web application before the session timeout occurs.</li>
  <li>Then after login I see the expected URL: localhost:8080/SecurityWeb/index.jsp</li>
  </ol>
  
  <p>This works NOT as expected:</p>
  
  <ol start="6">
  <li>Login works as follows:</li>
  <li>Invoking in Browser the URL localhost:8080/SecurityWeb/</li>
  <li>Then the login page is shown in Browser.</li>
  <li>Waiting until the session-timeout occurs.</li>
  <li>Then login to web application.</li>
  <li>Then after login I see the NOT expected URL: localhost:8080/SecurityWeb/j_security_check</li>
  </ol>
  
  <p>Questions:
  What has to be done to solve the problem?</p>
  
  <pre><code>snip from web.xml :
  
  
  &lt;display-name&gt;SecurityWeb&lt;/display-name&gt;
  
  &lt;welcome-file-list&gt;
  &lt;welcome-file&gt;index.jsp&lt;/welcome-file&gt;
  &lt;/welcome-file-list&gt;
  &lt;security-constraint&gt;
  
      &lt;web-resource-collection&gt;
  &lt;web-resource-name&gt;All&lt;/web-resource-name&gt;
  &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/web-resource-collection&gt;
  
  &lt;auth-constraint&gt;
      &lt;description&gt;...&lt;/description&gt;
      &lt;role-name&gt;administrator&lt;/role-name&gt;
      &lt;role-name&gt;customer&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  
   &lt;/security-constraint&gt;
  
  &lt;login-config&gt;
      &lt;auth-method&gt;FORM&lt;/auth-method&gt;
      &lt;form-login-config&gt;
      &lt;form-login-page&gt;/login.jsp&lt;/form-login-page&gt;
      &lt;form-error-page&gt;/error.jsp&lt;/form-error-page&gt;
      &lt;/form-login-config&gt;
    &lt;/login-config&gt;
  
    &lt;security-role&gt;
      &lt;description&gt;Admin&lt;/description&gt;
      &lt;role-name&gt;administrator&lt;/role-name&gt;
    &lt;/security-role&gt;
    &lt;security-role&gt;
      &lt;description&gt;Customer&lt;/description&gt;
      &lt;role-name&gt;customer&lt;/role-name&gt;
    &lt;/security-role&gt;
  
  &lt;session-config&gt;
  &lt;session-timeout&gt;1&lt;/session-timeout&gt;
  &lt;/session-config&gt;
  
  +-------------------------------------------------+
  
  snip from login.jsp :
  
  &lt;form method="post" ACTION="j_security_check"&gt;
  id: &lt;input type="text" name="j_username" /&gt; &lt;br&gt;
  pw: &lt;input type="password" name="j_password" /&gt; &lt;br&gt;
  &lt;input type="submit" name="login" value="Login"&gt;
  &lt;/form&gt;
  
  +-------------------------------------------------+
  
  Farisola
  </code></pre>