I'm trying to establish concurrent session control with non-xml Spring Security, so a user can't log in if he is already logged in in another device. I used .sessionManagement() .maximumSessions(1) .maxSessionsPreventsLogin(true)
, but using Chrome and Firefox I still can log in concurrently.
I have tried configuring HttpSessionEventPublisher
as instructed by another post, but I'm still able to log in concurrently.
This is my WebSecurityConfigurerAdapter
:
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private AccessDeniedHandler accessDeniedHandler;
@Autowired
UsuarioRepository usuarioRepository;
@Bean
public UserDetailsService mongoUserDetails() {
return new DinamicaUserDetailsService();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
UserDetailsService userDetailsService = mongoUserDetails();
auth.userDetailsService(userDetailsService);
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/",
"/home",
"/about",
"/registro",
"/session-error",
"/img/**",
"/img/*").permitAll()
.antMatchers("/admin/**").hasAnyRole("ADMIN")
.antMatchers("/user/**").hasAnyRole("USER")
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/login")
.permitAll()
.and()
.logout()
.logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
.logoutSuccessUrl("/login?logout")
.permitAll()
.invalidateHttpSession(true)
.and()
.sessionManagement()
.maximumSessions(1)
.expiredUrl("/session-error")
.maxSessionsPreventsLogin(true);
}
}
I expect it to show an error if I try to log in in Chrome while still logged in in Firefox, but the second concurrent login is successful.