You can start a timer equal to the session timeout, along with a continuous ajax request that will log the user out of the system if the page never refreshes. Another idea would be to host the URL that you click in a separate web application in the same domain. I am not sure if Spring has something built in for what you are doing.
I thought about it a little more. You can implement your own session registry that ignores Ajax URLs. Basically, you would not set the last access time for the user in the session registry if the URL matches the ignore list or filter defined in the Spring filter chain.
See SessionRegistry
source share