title: navigating to spring security login page redirects to invalid-session-url
body: <p>In order to redirect the user to a url that I desire on session timeout I recently added the following to my spring security file....</p>
  
  <pre><code>&lt;http pattern="/resources/**" security="none"/&gt;
  &lt;http pattern="/resources/js/**" security="none"/&gt;
  &lt;http pattern="/resources/css/**" security="none"/&gt;
  &lt;!-- excluded pages --&gt;
  &lt;http pattern="/login.htm" security="none"/&gt;
  &lt;http pattern="/j_spring_security_check" security="none"/&gt;
  &lt;http pattern="/accessDenied.htm" security="none"/&gt; 
  &lt;http pattern="/error.htm" security="none"/&gt;
  
  &lt;http use-expressions="true" auto-config="false" entry-point-ref="loginUrlAuthenticationEntryPoint"&gt;    
      &lt;!-- custom filters --&gt;
      &lt;custom-filter position="FORM_LOGIN_FILTER" ref="twoFactorAuthenticationFilter" /&gt;      
      &lt;custom-filter after="SECURITY_CONTEXT_FILTER" ref="securityLoggingFilter"/&gt;
      &lt;!-- session management --&gt;     
      &lt;session-management 
          invalid-session-url="/sessionExpired.htm" 
          session-authentication-error-url="/alreadyLoggedIn.htm"&gt;
  
          &lt;concurrency-control 
              max-sessions="1" 
              expired-url="/sessionExpiredDuplicateLogin.htm" 
              error-if-maximum-exceeded="false" 
              session-registry-alias="sessionRegistry"/&gt;
  
      &lt;/session-management&gt;   
  </code></pre>
  
  <p>When the session expires on the next click the user is taken to /sessionExpired.htm which is the desired effect HOWEVER i now have an issue when I navigate to the login page (login.htm), i am redirected to invalid-session-url (/sessionExpired.htm). </p>
  
  <p>Obviously this is not what I want to happen. I've been doing some reading on it and one of the suggested solutions seems to be to delete the jsessionid cookie like such and also set invalidate-session to false (I now invalidate session in the controller method for logout.htm) ...</p>
  
  <pre><code>&lt;logout logout-success-url="/logout.htm" invalidate-session="false" delete-cookies="JSESSIONID"/&gt;
  </code></pre>
  
  <p>which I have tried but doesn't seem to work. Can someone please help me understand what is happening here and how I might resolve? It seems as if when i go to the login page it is trying to remember who I am.</p>
  
  <p>thanks</p>