Spring security - expireNow() on session does not do anything

Question

We are using a "ConcurrentSessionControlAuthenticationStrategy", with the following configuration:

    <bean
                class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
                <constructor-arg ref="clusteredSessionRegistryImpl" />
                <property name="maximumSessions" value="1" />
                <property name="exceptionIfMaximumExceeded" value="false" />
            </bean>

When a user logs in, and then logs in for the second time from a different browser - we can see the following code being invoked (as expected):

 protected void allowableSessionsExceeded(List<SessionInformation> sessions, int allowableSessions,
        SessionRegistry registry) throws SessionAuthenticationException {
    ...
    leastRecentlyUsed.expireNow();
}

The "leastRecentlyUsed" is the actual older session (as expected). Now, All is well but the fact that this expiration does not kill eventually the older session, the other browser session that should be expired can still use the application in concurrency with the newer session in the other browser. it seems like the process of the actual destruction of the session does not take place.

1) Who\\What is responsible of destroying the session?

2) How can we fix this issue?

Answer 1

I had a similar problem and it turned out to be the browser cache. See this question here

In my case, I cleared the cache and noticed that the browser that was supposed to be logged out eventually was unable to access the content of my web App.

Update

Eventually found out that we use two configurations in our backend for the security context.

I had to make the Session Registry static and call the same instance in both configurations.

private static final SessionRegistry SESSION_REGISTRY = new SessionRegistryImpl();

Then setup a bean:

@Bean
public static SessionRegistry sessionRegistry() {
    return SESSION_REGISTRY;
}

And finally use the same instance in both configurations:

httpSecurity
    ... // you configuration
    .sessionManagement()
        .maximumSessions(5)
        .maxSessionsPreventsLogin(true)
    .sessionRegistry(sessionRegistry()).and()

Hope this helps someone else :)