title: Prevent invalid session redirect for Spring authentication request with expired session
body: <p>In a web application using Spring 4.1 / Spring Security 4.0 I would like to prevent a session expired redirect for authentication requests even if the current session has in fact expired.</p>
  
  <p>The current behavior is this:</p>
  
  <ul>
  <li>User opens application login page in web browser and then leaves the page open without logging in until the current session has expired, or more likely returns to the application after logging out (which returns the login form) and a period of inactivity. Either way the current session has expired but the browser is showing the login form.</li>
  <li>User then enters credentials and clicks "Login"</li>
  <li>User is redirected to invalid session url (configured using the namespace with <code>invalid-session-url</code>)</li>
  </ul>
  
  <p>Clearly for the user this is surprising - you were looking at the login page, entered valid credentials, but then got a session timeout notice instead of getting logged in.</p>
  
  <p>What I would like to happen is that the authentication request is processed in the normal way when the user submits the login form, regardless of whether or not the current <code>HttpSession</code> is valid (with a new session created as necessary).</p>
  
  <p>It seems that a possible solution might be to inject a custom <code>InvalidSessionStrategy</code> in place of the default <code>SimpleRedirectInvalidSessionStrategy</code> used by the <code>SessionManagementFilter</code> so that authentication requests are not redirected. But I cannot see a simple way to do this with the namespace configuration - which also makes me wonder if there is an alternative solution that might be a better option, or if there is a reason why this is not available using the namespace.</p>
  
  <p>Am I missing something?</p>
  
  <p>Thanks.</p>