spring security session timeout

Question

I use Spring Security 3 in my JSF2 webapp.

I have a security rule to provide session timeouts:

Answer 1

You want to use the expired-session-url property for expired sessions, not the invalid-session-url. They are for two different things.