Unable to publish SessionDestroyedEvent

All the way back since upgrading to spring-boot 2.x from 1.x, I get regular warning logs with messages similar like this:

2019-04-03 07:58:07.801  WARN 7 --- [nerContainer-14] s.s.d.r.RedisOperationsSessionRepository : Unable to publish SessionDestroyedEvent for session 98a40998-...

I have seen the other (closed) issues and have, lacking a solution, ignored the problem so far.

Now a user reported that he got the following error screen, and I think this is related (white page, only this text):

This session has been expired (possibly due to multiple concurrent logins being attempted as the same user).

Here is some relevant configuration. Please note that I added the SessionEventPublisher and the SessionRegistry as means to get mor data for that problem (no avail so far).

Environment:

• OpenJDK11
• spring-boot 2.1.3.RELEASE
• Redis 3.2 (Docker image)

Now I'm looking for the flaw in my configuration.

@EnableRedisHttpSession(maxInactiveIntervalInSeconds = SESSION_TIMEOUT)
public class HttpSessionConfig {

    static final int SESSION_TIMEOUT = 24 * 3600;

    static final String COOKIE_NAME_SESSION = "SESSION";

    @Bean
    public CookieSerializer cookieSerializer() {
        DefaultCookieSerializer cookieSerializer = new DefaultCookieSerializer();
        cookieSerializer.setCookieName(COOKIE_NAME_SESSION);
        cookieSerializer.setCookiePath("/");
        return cookieSerializer;
    }

    @Bean
    public HttpSessionEventPublisher httpSessionEventPublisher() {
        return new HttpSessionEventPublisher();
    }

    @Bean
    public SessionRegistry sessionRegistry(RedisOperationsSessionRepository sessionRepository) {
        return new SpringSessionBackedSessionRegistry<>(sessionRepository);
    }
}

@Configuration
public static class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .requestMatchers()
                    .antMatchers("/", "/zuul/**", "/api/**", "/public/**", "/login", "/logout")
                    .and()

                // configure where we need logins
                .authorizeRequests()
                    .antMatchers("/public/**", "/login").permitAll()
                    .antMatchers("/zuul/xy/**").permitAll()
                    .anyRequest().authenticated()
                    .and()

                .sessionManagement()
                    .maximumSessions(10)
                    .sessionRegistry(sessionRegistry)
                    .and()
                    .and()

                .formLogin()
                    .loginPage("/login")
                    .successHandler(successHandler)
                    .permitAll()
                    .and()

                .logout()
                    .logoutUrl("/logout")
                    .invalidateHttpSession(true)
                    .addLogoutHandler(logoutHandler)
                    .deleteCookies(COOKIE_NAME_SESSION)
                    .logoutSuccessHandler(logoutSuccessHandler)
                    .permitAll()
                    .and()

                .rememberMe()
                    .key(rememberMeKey)
                    .rememberMeServices(rememberMeServices)
                    .and()

                .csrf()
                    .csrfTokenRepository(csrfTokenRepository)
                    .and()
        ;
    }
}

Start with RedisOperationsSessionRepository and the warning about publishing SessionDestroyedEvent, then compare the provided HttpSessionConfig and SecurityConfiguration, including HttpSessionEventPublisher and SpringSessionBackedSessionRegistry. Reproduce the warning with the stated Spring Boot, Redis, and Java environment and determine whether the configuration explains the expired-session screen; done means the cause and a verified correction are identified.