Disable multiple logins for same user in spring security + spring boot

Question

I have the below Spring Security configuration:

static SessionRegistry SR;
@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
            .antMatchers("/", "/forgotPwd", "/resetPwd").permitAll()
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .loginPage("/login")
            .defaultSuccessUrl("/home")
            .failureUrl("/login?error")
            .permitAll()
            .successHandler(authenticationSuccessHandler) // autowired or defined below
            .and()
        .logout()
            .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
            .logoutSuccessHandler(myLogoutSuccessHandler)
            .permitAll()
            .and()
        .sessionManagement()
            .maximumSessions(1)
            .maxSessionsPreventsLogin(true)
            .sessionRegistry(SR);
}

@Bean
public ServletListenerRegistrationBean<HttpSessionEventPublisher> httpSessionEventPublisher() {
    return new ServletListenerRegistrationBean<HttpSessionEventPublisher>(new HttpSessionEventPublisher());
}

I was expecting sessionManagement().maximumSessions(1) to disable multiple login for the same user. It is working, but first user logout the application, so I am trying login in another browser but it showing This account is already using by someone.

Kindly request you to let me know where its going wrong.

Answer 1

Remove your httpSessionEventPublisher and SessionRegistry

Try this config:

@Override
protected void configure(HttpSecurity http) throws Exception {
  http
      .authorizeRequests()
          .antMatchers("/", "/forgotPwd", "/resetPwd").permitAll()
          .anyRequest().authenticated()
          .and()
      .formLogin()
         .loginPage("/login")
         .defaultSuccessUrl("/home")
         .failureUrl("/login?error")
         .permitAll()
         .and()
      .sessionManagement()
         .maximumSessions(1);
}

You can set the session timout in the application.properties

server.session.timeout= # Session timeout in seconds.