diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java
index 7b97ded..d604ab3 100644
--- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java
+++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/config/BrowserSecurityConfig.java
@@ -118,6 +118,11 @@ public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
         //设置获取用户信息后登录的方式
         .userDetailsService(userDetailsService)
         .and()
+        // session管理的配置
+        .sessionManagement()
+        //定义session过期的时候处理的url
+        .invalidSessionUrl("/session/invalid")
+        .and()
         .authorizeRequests()//下面是权限配置
         //当访问这个页面的时候不进行身份认证,对用户自定义的登录页也不进行权限认证
         .antMatchers(SecurityConstants.MOBILE_LOGIN_PROCESSOR_URI
@@ -130,7 +135,9 @@ public class BrowserSecurityConfig extends WebSecurityConfigurerAdapter {
             , "/upms/user"
             //用户注册或绑定的页面
             ,securityProperties.getBrowser().getSignUpUrl()
-            ,"处理用户的注册绑定请求的url")
+            ,"处理用户的注册绑定请求的url"
+                //处理session请求的url
+            ,"/session/invalid")
         .permitAll()
         //任何请求
         .anyRequest()
diff --git a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/controller/BrowserSecurityController.java b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/controller/BrowserSecurityController.java
index 404c815..8f0c2b7 100644
--- a/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/controller/BrowserSecurityController.java
+++ b/boot-starter/boot-starter-security/boot-starter-security-browser/src/main/java/com/micro/fast/security/browser/controller/BrowserSecurityController.java
@@ -25,6 +25,8 @@ import org.springframework.web.context.request.ServletWebRequest;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
 
 /**
  * 自定义登录认证处理方式,当触发登录认证的时候跳转到这里
@@ -87,5 +89,17 @@ public class BrowserSecurityController {
         socialUserInfo.setHeadingUrl(connectionFromSession.getImageUrl());
         return socialUserInfo;
     }
+
+    /**
+     * 处理session过期
+     * @return
+     */
+    @GetMapping("/session/invalid")
+    @ResponseStatus(HttpStatus.UNAUTHORIZED)
+    public Map sessionInvalid(){
+        HashMap<String, String> result = new HashMap<>();
+        result.put("msg","登录时间过长，请重新登录");
+        return result;
+    }
 }
 
diff --git a/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml b/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml
index 0da9850..4a89526 100644
--- a/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml
+++ b/boot-starter/boot-starter-security/boot-starter-security-demo/src/main/resources/application.yml
@@ -20,4 +20,9 @@ ms:
   code:
     image:
      length: 4
+# 应用session的管理
+server:
+  session:
+#  超时时间，单位是秒，但是不能小于一分钟
+    timeout: 120