4

The default behavior of concurrency control is to expire the original session. However, I would like to block the second user which is logging in with the same credentials with displaying message "User has already logged in". How can I accomplish this ?

Below is the configuration of spring-security.xml:

<http auto-config="false" use-expressions="true">
    <intercept-url pattern="/login*" access="permitAll"
        requires-channel="https" />
    <intercept-url pattern="/userHasLoggedIn" access="permitAll"
        requires-channel="https" />
    <intercept-url pattern="/j_spring_security_*" access="permitAll"
        requires-channel="https" />
    <intercept-url pattern="/session*" access="permitAll"
        requires-channel="https" />
    <form-login login-page="/login" authentication-failure-url="/loginFailed" />
    <intercept-url pattern="/**" access="isAuthenticated()"
        requires-channel="https" />
    <session-management invalid-session-url="/sessionExpired" session-authentication-error-url="/loginAlready">
        <concurrency-control error-if-maximum-exceeded="false" expired-url="/userHasLoggedIn" max-sessions="1"/>
    </session-management>
    <logout delete-cookies="JSESSIONID" />
</http>

(Updated) My final spring security configuration:

<http auto-config="false" use-expressions="true">
        <intercept-url pattern="/login*" access="permitAll"
            requires-channel="https" />
        <form-login default-target-url="/home" login-page="/login" authentication-failure-url="/loginFailed" />
        <intercept-url pattern="/**" access="isFullyAuthenticated()"
            requires-channel="https" />
        <session-management session-authentication-error-url="/loginFailed">
            <concurrency-control expired-url="/loginFailed" error-if-maximum-exceeded="true" max-sessions="1"/>
        </session-management>
        <logout delete-cookies="JSESSIONID" />
    </http>
4
  • 2
    The reason most applications expire the first session is that, with http, it is difficult to know for sure that it is still in use. Think of the case your user's browser is closed accidentally or hangs. Your user may try to reconnect immediately and your app may reject the connection because it thinks the previous session is still ongoing.
    – Eduardo
    Oct 20, 2012 at 6:32
  • Can it be solved by using session timeout in web.xml ?
    – abiieez
    Oct 21, 2012 at 6:19
  • 1
    Although you can time out a session, it would not solve the case I mentioned above. The user would have to wait for the session to time out before being able to successfully log in again. You could make the time-out duration small but that would harm users who are logged in to a session and become inactive for that small period. There are workarounds (like sending "heartbeats" in the background) but it can get complicated.
    – Eduardo
    Oct 21, 2012 at 10:51
  • I am trying to achieve same thing but facing issue mentioned by @Eduardo in case of browser closed/crashed I am not able to login again until session got expired. So is there any API or setting provided by spring to overcome this issue.
    – ManojP
    Aug 1, 2015 at 17:31

1 Answer 1

11

The solution is in the documentation:

Often you would prefer to prevent a second login, in which case you can use

<http>
  ...
  <session-management>
      <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
  </session-management>
</http>

The second login will then be rejected. By “rejected”, we mean that the user will be sent to the authentication-failure-url if form-based login is being used. If the second authentication takes place through another non-interactive mechanism, such as “remember-me”, an “unauthorized” (402) error will be sent to the client. If instead you want to use an error page, you can add the attribute session-authentication-error-url to the session-management element.

So basically set error-if-maximum-exceeded to "true" and remove expired-url attribute from <concurrency-control>.

3
  • 2
    It help me too, however I am still looking to destroy session on browser closed/hang.
    – ManojP
    Aug 1, 2015 at 17:35
  • @ManojP how would you find out that the browser was closed? Nov 27, 2018 at 13:54
  • 1
    will this work with cluster of tomcat server as individual tomcat will maintain separate session. does this feature use database.
    – Jafar Ali
    Apr 25, 2019 at 8:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.