spring-projects / spring-projects/spring-session
.sessionRegistry(sessionRegistry()) doesn't seem necessary; documentation should be updated accordingly
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.9k
- Forks
- 1.2k
- Avg merge
- 4h 27m
- Merged PRs (30d)
- 55
Description
Describe the bug
I've set up Spring Session JDBC and Spring Security in my Spring Boot 2.2.7 application.
I've set the maximum number of sessions for a user to 1 with http.sessionManagement().maximumSessions(1)
And that works. Which surprises me.
I did not do .sessionRegistry(sessionRegistry()) as documented at https://docs.spring.io/spring-session/docs/current/reference/html5/#spring-security-concurrent-sessions
So it seems that .sessionRegistry(sessionRegistry()) is not necessary leading me to believe that the documentation should be updated to remove this step.
To Reproduce
- Make a an application using Spring Boot 2.2.7, Spring Security, and Spring Session
- Configure Spring Security using
http.sessionManagement().maximumSessions(1)
Login twice as the same user with different HTTP session (you can use a different browser, private browsing mode, different computers, etc).
When the when the second session logs in, the first session is logged out.
Expected behavior
Based on https://docs.spring.io/spring-session/docs/current/reference/html5/#spring-security-concurrent-sessions since .sessionRegistry(sessionRegistry()) is not set, I would have expected the first session to remain authenticated when the second session logs in.
Sample
https://github.com/candrews/spring-session-session-registry-sample
A test is included. I expect the test not to pass unless .sessionRegistry(sessionRegistry()) is done.
Test: https://github.com/candrews/spring-session-session-registry-sample/blob/master/src/test/java/com/example/demo/SingleConcurrentSessionConfigurerTest.java
Configuration (see comments): https://github.com/candrews/spring-session-session-registry-sample/blob/master/src/main/java/com/example/demo/WebSecurityConfiguration.java
Run ./mvnw test to run the test.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Spring Security concurrent sessions section in the linked reference and compare its sessionRegistry requirement with the sample's WebSecurityConfiguration.java. Run ./mvnw test in the sample and inspect SingleConcurrentSessionConfigurerTest.java to verify the documented setup and expected behavior. Done means the documentation accurately states whether sessionRegistry registration is required.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring, spring-boot
- Domain
- backend, documentation
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100