JSF 2.3: Session expired vs ViewExpired problems - jsf

Question

I am using JSF 2.3 (Mojarra), with PrimeFaces 7 on WildFly 17 and have a problem with (I suppose) an expired http ession, which I was not able to answer using the links below:
keep getting javax.faces.application.ViewExpiredException: viewId with jsf 2
JSF 2.3 Form Based Login and ViewExpiredException
To test my assumption I have put the following entry in my web.xml:
<session-config>
<cookie-config>
<http-only>true</http-only>
</cookie-config>
<session-timeout>1</session-timeout>
</session-config>
After deploying the application I opened two pages of it in different browsers:
The first page requires login that I performed successfully and then opened the page.
The second page requires a click on a link only (without login) and opens upon clicking this link.
Both pages use ViewScoped beans.
I wait a little more than one minute, when, according to the configuration above, the session should have expired.
1.) On the first page: when I click on the button below:
<p:commandButton icon="ui-icon-check" value="....." action="#{aveAngelBean.aveAngelegtOK}" update="#form" />
I only see that in the lower right corner a circle spins indicating that probably a JavaScript is executed, but nothing happens otherwise. I do not get any error in the console. When I click a second time on the button, nothing happens. Also, no code is executed on the server
2.) On the second page: when I click on the button below:
<p:commandButton icon = "ui-icon-check" value="#{msg['immobilien.ave.go.forward']}" action="#{persDatenBean.weiterUnterlagen}" update="#form">
<f:param name="validateOnWeiter" value="true"/>
</p:commandButton>
the #init method of the backing bean gets executed - meaning probably an attempt from the server to restore the view.
Then an error occurs, because the HTTP GET parameter, found in the URL of the link, which I initially invoked to get to this page:
?linkId=c91cc387-45f4-4c22-8829-4e3fd266c311_abd45a61-0e4e-4e7b-aa48-e9d858a5dbb9
is not being found.
My questions are:
1.) About the first page: How can I show the login-page instead of showing nothing?
2.) About the second page: How can I reload the page, when clicking the button, WITH the HTTP GET parameter that I used to initially invoke the page? Why is this parameter
?linkId=c91cc387-45f4-4c22-8829-4e3fd266c311_abd45a61-0e4e-4e7b-aa48-e9d858a5dbb9
somehow not considered at the time of pressing the button?
Below my web.xml:
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
version="3.0">
<context-param>
<param-name>javax.faces.STATE_SAVING_METHOD</param-name>
<param-value>server</param-value>
</context-param>
<context-param>
<param-name>javax.faces.PROJECT_STAGE</param-name>
<param-value>Development</param-value>
</context-param>
<context-param>
<param-name>primefaces.THEME</param-name>
<param-value>sapphire-#{guestPreferences.theme}</param-value>
</context-param>
<context-param>
<param-name>primefaces.FONT_AWESOME</param-name>
<param-value>true</param-value>
</context-param>
<context-param>
<param-name>javax.faces.FACELETS_LIBRARIES</param-name>
<param-value>/WEB-INF/primefaces-sapphire.taglib.xml</param-value>
</context-param>
<!-- #see http://jsfcorner.blogspot.co.at/2014/01/client-side-validation-example-of.html -->
<context-param>
<param-name>primefaces.CLIENT_SIDE_VALIDATION</param-name>
<param-value>true</param-value>
</context-param>
<context-param>
<param-name>primefaces.FONT_AWESOME</param-name>
<param-value>true</param-value>
</context-param>
<listener>
<listener-class>com.sun.faces.config.ConfigureListener</listener-class>
</listener>
<filter>
<filter-name>Character Encoding Filter</filter-name>
<filter-class>org.primefaces.sapphire.filter.CharacterEncodingFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>Character Encoding Filter</filter-name>
<servlet-name>Faces Servlet</servlet-name>
</filter-mapping>
<!-- JSF mapping -->
<servlet>
<servlet-name>Faces Servlet</servlet-name>
<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet>
<servlet-name>Job Repair Servlet</servlet-name>
<servlet-class>at.home.digest.web.ave.JobRepairServlet</servlet-class>
<load-on-startup>0</load-on-startup>
</servlet>
<servlet>
<servlet-name>InitServlet Servlet</servlet-name>
<servlet-class>at.home.digest.web.ave.InitServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet>
<servlet-name>Download Servlet</servlet-name>
<servlet-class>at.home.digest.web.DownloadServlet</servlet-class>
<load-on-startup>0</load-on-startup>
</servlet>
<!-- Map these files with JSF -->
<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>*.jsf</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>*.faces</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>*/faces/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>*.xhtml</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Job Repair Servlet</servlet-name>
<url-pattern>/ave/makler/admin/jobRep</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Download Servlet</servlet-name>
<url-pattern>/heimdi/ave/download</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Download Servlet</servlet-name>
<url-pattern>/ave/download</url-pattern>
</servlet-mapping>
<security-constraint>
<web-resource-collection>
<web-resource-name>All resources in /ave/makler/*</web-resource-name>
<description>All resources in /ave/makler/*</description>
<url-pattern>/ave/makler/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>makler</role-name>
<role-name>maklerChef</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>jBossJaasHeimdiRealm</realm-name>
<form-login-config>
<form-login-page>/login/login.jsf</form-login-page>
<form-error-page>/login/loginFailed.jsf</form-error-page>
</form-login-config>
</login-config>
<security-role>
<role-name>makler</role-name>
</security-role>
<security-role>
<role-name>maklerChef</role-name>
</security-role>
<security-role>
<role-name>kaufer</role-name>
</security-role>
<session-config>
<cookie-config>
<http-only>true</http-only> <!-- https://owasp.org/www-community/HttpOnly , #see also: https://www.cookiepro.com/knowledge/httponly-cookie/ -->
<!-- <secure>true</secure> --> <!-- https://owasp.org/www-community/controls/SecureCookieAttribute -->
</cookie-config>
<session-timeout>1</session-timeout>
</session-config>
<error-page>
<exception-type>javax.servlet.ServletException</exception-type>
<location>/error.faces</location>
</error-page>
<error-page>
<exception-type>javax.faces.FacesException</exception-type>
<location>/error.faces</location>
</error-page>
<error-page>
<exception-type>java.lang.Exception</exception-type>
<location>/error.faces</location>
</error-page>
<!--
<error-page>
<exception-type>javax.faces.application.ViewExpiredException</exception-type>
<location>/error.faces</location>
</error-page>
-->
</web-app>
Thank you

Answer 1

Just debug your Session issues with this SessionDebugListener...
import javax.servlet.http.HttpSessionEvent;
import javax.servlet.http.HttpSessionListener;
import lombok.extern.slf4j.Slf4j;
/**
* HttpSessionListener to monitor the creation and destruction of JSESSIONs.
*/
#Slf4j
public class SessionDebugListener implements HttpSessionListener {
#Override
public void sessionCreated(final HttpSessionEvent se) {
LOG.info("Session Created {}", se.getSession().getId());
}
#Override
public void sessionDestroyed(final HttpSessionEvent se) {
LOG.info("Session Destroyed {}", se.getSession().getId());
}
}
web.xml
<web-app ...>
<listener>
<listener-class>com.your.SessionDebugListener </listener-class>
</listener>
</web-app>
Here is a more advanced example: https://www.baeldung.com/httpsessionlistener_with_metrics