spring-projects / spring-projects/spring-session

.sessionRegistry(sessionRegistry()) doesn't seem necessary; documentation should be updated accordingly

Open
#1,629 7 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

in: docs status: feedback-provided type: bug
Dominant language
Java
Stars
1.9k
Forks
1.2k
Avg merge
4h 27m
Merged PRs (30d)
55

Description

Describe the bug
I've set up Spring Session JDBC and Spring Security in my Spring Boot 2.2.7 application.
I've set the maximum number of sessions for a user to 1 with http.sessionManagement().maximumSessions(1)
And that works. Which surprises me.
I did not do .sessionRegistry(sessionRegistry()) as documented at https://docs.spring.io/spring-session/docs/current/reference/html5/#spring-security-concurrent-sessions
So it seems that .sessionRegistry(sessionRegistry()) is not necessary leading me to believe that the documentation should be updated to remove this step.

To Reproduce

  • Make a an application using Spring Boot 2.2.7, Spring Security, and Spring Session
  • Configure Spring Security using http.sessionManagement().maximumSessions(1)

Login twice as the same user with different HTTP session (you can use a different browser, private browsing mode, different computers, etc).

When the when the second session logs in, the first session is logged out.

Expected behavior
Based on https://docs.spring.io/spring-session/docs/current/reference/html5/#spring-security-concurrent-sessions since .sessionRegistry(sessionRegistry()) is not set, I would have expected the first session to remain authenticated when the second session logs in.
Sample
https://github.com/candrews/spring-session-session-registry-sample

A test is included. I expect the test not to pass unless .sessionRegistry(sessionRegistry()) is done.
Test: https://github.com/candrews/spring-session-session-registry-sample/blob/master/src/test/java/com/example/demo/SingleConcurrentSessionConfigurerTest.java
Configuration (see comments): https://github.com/candrews/spring-session-session-registry-sample/blob/master/src/main/java/com/example/demo/WebSecurityConfiguration.java

Run ./mvnw test to run the test.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Spring Security concurrent sessions section in the linked reference and compare its sessionRegistry requirement with the sample's WebSecurityConfiguration.java. Run ./mvnw test in the sample and inspect SingleConcurrentSessionConfigurerTest.java to verify the documented setup and expected behavior. Done means the documentation accurately states whether sessionRegistry registration is required.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring, spring-boot
Domain
backend, documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.