title: Spring Security Redirecting to invalid-session-url on a fresh application launch
body: <p>I have just configured session management into my web app, but Spring keeps redirecting to the invalid-session-url specified in the session management. When the contextPath is been launched in the browser before me attempting login and session expiring.</p>
  <p>This is my configuration below:</p>
  <pre><code> &lt;beans:beans xmlns=&quot;http://www.springframework.org/schema/security&quot;
  xmlns:beans=&quot;http://www.springframework.org/schema/beans&quot; 
  xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot;
  xsi:schemaLocation=&quot;http://www.springframework.org/schema/beans
  http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
  http://www.springframework.org/schema/security
  http://www.springframework.org/schema/security/spring-security-3.2.xsd&quot;&gt;
  
  &lt;http auto-config=&quot;true&quot; use-expressions=&quot;true&quot;&gt;
              &lt;intercept-url pattern=&quot;/login*&quot; access=&quot;permitAll&quot; /&gt;
              &lt;intercept-url pattern=&quot;/styles/calvary.css&quot; access=&quot;permitAll&quot; /&gt;
              &lt;intercept-url pattern=&quot;/styles/vendor/foundation.min.css&quot; access=&quot;permitAll&quot; /&gt;
              &lt;intercept-url pattern=&quot;/styles/vendor/normalize.css&quot; access=&quot;permitAll&quot; /&gt;
              &lt;intercept-url pattern=&quot;/styles/fonts/gothic.eot&quot; access=&quot;permitAll&quot; /&gt;
              &lt;intercept-url pattern=&quot;/styles/fonts/gothic.woff&quot; access=&quot;permitAll&quot; /&gt;
              &lt;intercept-url pattern=&quot;/styles/fonts/gothic.ttf&quot; access=&quot;permitAll&quot; /&gt;
              &lt;intercept-url pattern=&quot;/scripts/vendor/vendor/modernizr.js&quot; access=&quot;permitAll&quot; /&gt;
              &lt;intercept-url pattern=&quot;/scripts/vendor/vendor/jquery.js&quot; access=&quot;permitAll&quot; /&gt;
              &lt;intercept-url pattern=&quot;/scripts/vendor/foundation/foundation.min.js&quot; access=&quot;permitAll&quot; /&gt;
              &lt;intercept-url pattern=&quot;/scripts/vendor/foundation/foundation.abide.js&quot; access=&quot;permitAll&quot; /&gt;
              &lt;intercept-url pattern=&quot;/scripts/calvary.js&quot; access=&quot;permitAll&quot; /&gt;
              &lt;intercept-url pattern=&quot;/images/lg.png&quot; access=&quot;permitAll&quot; /&gt;
              &lt;intercept-url pattern=&quot;/images/red_indicator.gif&quot; access=&quot;permitAll&quot; /&gt;
              &lt;intercept-url pattern=&quot;/**&quot; access=&quot;isAuthenticated()&quot; /&gt;
              &lt;form-login login-page=&quot;/login&quot; default-target-url=&quot;/index&quot;  authentication-failure-url=&quot;/login?error&quot; username-parameter=&quot;username&quot; password-parameter=&quot;password&quot; /&gt;
              &lt;logout  logout-success-url=&quot;/login?logout&quot; invalidate-session=&quot;false&quot; delete-cookies=&quot;JSESSIONID&quot;/&gt;
              &lt;csrf/&gt;
              &lt;session-management  session-authentication-error-url=&quot;/login?expire=3&quot; invalid-session-url=&quot;/login?expire=3&quot; session-fixation-protection=&quot;migrateSession&quot;&gt;
                  &lt;concurrency-control error-if-maximum-exceeded=&quot;true&quot; max-sessions=&quot;1&quot; expired-url=&quot;/login?expire&quot;/&gt;
              &lt;/session-management&gt;
              
      &lt;/http&gt;
      
      
      &lt;authentication-manager&gt;
          &lt;authentication-provider ref=&quot;calvaryLogger&quot;/&gt;
      &lt;/authentication-manager&gt;
      &lt;beans:bean name=&quot;calvaryLogger&quot; class=&quot;com.apr.authenticator.CalvaryLogger&quot; /&gt; 
  &lt;/beans:beans&gt;
  </code></pre>
  <p>I will really appreciate any assistance.
  Thanks</p>
  <p><strong>EDIT</strong></p>
  <p>Below is my web.xml</p>
  <pre><code>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
  &lt;web-app version=&quot;3.1&quot; xmlns=&quot;http://xmlns.jcp.org/xml/ns/javaee&quot; xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; xsi:schemaLocation=&quot;http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd&quot;&gt;
  
  &lt;servlet&gt;
      &lt;servlet-name&gt;dispatcher&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
      &lt;load-on-startup&gt;2&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;dispatcher&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  &lt;session-config&gt;
      &lt;session-timeout&gt;1&lt;/session-timeout&gt;
      &lt;tracking-mode&gt;COOKIE&lt;/tracking-mode&gt;
  &lt;/session-config&gt;
  &lt;welcome-file-list&gt;
      &lt;welcome-file&gt;redirect.jsp&lt;/welcome-file&gt;
  &lt;/welcome-file-list&gt;
  &lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;/WEB-INF/applicationContext.xml
          /WEB-INF/spring-security.xml
      &lt;/param-value&gt;
  &lt;/context-param&gt;
  &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;
   &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.security.web.session.HttpSessionEventPublisher&lt;/listener-class&gt;
  &lt;/listener&gt;
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
      &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
          &lt;error-page&gt;
         &lt;error-code&gt;404&lt;/error-code&gt;
         &lt;location&gt;/WEB-INF/viewList/404.html&lt;/location&gt;
        &lt;/error-page&gt;
     &lt;/web-app&gt;
  </code></pre>