Missing example with Spring Security maximum sessions feature

There is no example to illustrate session management with maximum sessions.

The java code is:

            .sessionManagement()
                .maximumSessions(1)
                .maxSessionsPreventsLogin(false)
                .expiredUrl("/login?expired")

but logout does not invalidate the login.

There are some forums that mention org.springframework.security.web.session.HttpSessionEventPublisher, but it’s supposed to be added to web.xml, which Spring Boot doesn’t use.

I can’t piece it together into code that successfully logs the user out and allows for a new login.

[rwinch]

There are a few things going on here

• As mentioned previously, Spring Security requires a HttpSessionListener (HttpSessionEventPublisher) to be registered. It would be nice if Spring Boot documented how to register a HttpSessionListener. I created #2518 to address this.
• Spring Security has a bug that means the SessionDestroyedEvent will not be received by the SessionRegistryImpl. The workaround is to explicitly provide the SessionRegistryImpl

A complete example can be found below:

@EnableWebMvcSecurity
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                    .antMatchers("/expired").permitAll()
                    .anyRequest().authenticated()
                    .and()
                .formLogin()
                    .and()
                .sessionManagement()
                    .maximumSessions(1)
                    .expiredUrl("/expired")
                    .maxSessionsPreventsLogin(true)
                    .sessionRegistry(sessionRegistry());
    }

    // Work around https://jira.spring.io/browse/SEC-2855
    @Bean
    public SessionRegistry sessionRegistry() {
        SessionRegistry sessionRegistry = new SessionRegistryImpl();
        return sessionRegistry;
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .inMemoryAuthentication()
                    .withUser("user").password("password").roles("USER");
    }

    // Register HttpSessionEventPublisher
    @Bean
    public static ServletListenerRegistrationBean httpSessionEventPublisher() {
        return new ServletListenerRegistrationBean(new HttpSessionEventPublisher());
    }
}

[wilkinsona]

@tanojkumar A closed issue from almost 3 years ago isn’t a good place to look for some help. Please use Stack Overflow or Gitter instead.