Hi,

I want that an invalid session is only redirected to the invalid-session-url if the request was going to an URL which needs authentication. Looking into the code of the filter this seems to be impossible.

How can I achieve that URLs marked with access="permitAll" are ignored by the filter?

Thank you