Package org.springframework.security.config.annotation.web.configurers

# Class SessionManagementConfigurer.ConcurrencyControlConfigurer

java.lang.Object
org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer.ConcurrencyControlConfigurer

Enclosing class:
  SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>

public final class SessionManagementConfigurer.ConcurrencyControlConfigurer extends Object
Allows configuring controlling of multiple sessions.

## Method Summary

Modifier and Type
Method
Description
`SessionManagementConfigurer<H>`
`and()`
Deprecated, for removal: This API element is subject to removal in a future version.
For removal in 7.0.
`SessionManagementConfigurer<H>.ConcurrencyControlConfigurer`
`expiredSessionStrategy(org.springframework.security.web.session.SessionInformationExpiredStrategy expiredSessionStrategy)`
Determines the behaviour when an expired session is detected.
`SessionManagementConfigurer<H>.ConcurrencyControlConfigurer`
`expiredUrl(String expiredUrl)`
The URL to redirect to if a user tries to access a resource and their session has been expired due to too many sessions for the current user.
`SessionManagementConfigurer<H>.ConcurrencyControlConfigurer`
`maximumSessions(int maximumSessions)`
Controls the maximum number of sessions for a user.
`SessionManagementConfigurer<H>.ConcurrencyControlConfigurer`
`maxSessionsPreventsLogin(boolean maxSessionsPreventsLogin)`
If true, prevents a user from authenticating when the `maximumSessions(int)` has been reached.
`SessionManagementConfigurer<H>.ConcurrencyControlConfigurer`
`sessionRegistry(org.springframework.security.core.session.SessionRegistry sessionRegistry)`
Controls the `SessionRegistry` implementation used.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Method Details

### maximumSessions

public SessionManagementConfigurer<H>.ConcurrencyControlConfigurer maximumSessions(int maximumSessions)
Controls the maximum number of sessions for a user. The default is to allow any number of users.

Parameters:
  `maximumSessions` - the maximum number of sessions for a user
Returns:
  the `SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>.ConcurrencyControlConfigurer` for further customizations

### expiredUrl

public SessionManagementConfigurer<H>.ConcurrencyControlConfigurer expiredUrl(String expiredUrl)
The URL to redirect to if a user tries to access a resource and their session has been expired due to too many sessions for the current user. The default is to write a simple error message to the response.

Parameters:
  `expiredUrl` - the URL to redirect to
Returns:
  the `SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>.ConcurrencyControlConfigurer` for further customizations

### expiredSessionStrategy

public SessionManagementConfigurer<H>.ConcurrencyControlConfigurer expiredSessionStrategy(org.springframework.security.web.session.SessionInformationExpiredStrategy expiredSessionStrategy)
Determines the behaviour when an expired session is detected.

Parameters:
  `expiredSessionStrategy` - the `SessionInformationExpiredStrategy` to use when an expired session is detected.
Returns:
  the `SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>.ConcurrencyControlConfigurer` for further customizations

### maxSessionsPreventsLogin

public SessionManagementConfigurer<H>.ConcurrencyControlConfigurer maxSessionsPreventsLogin(boolean maxSessionsPreventsLogin)
If true, prevents a user from authenticating when the `maximumSessions(int)` has been reached. Otherwise (default), the user who authenticates is allowed access and an existing user's session is expired. The user's who's session is forcibly expired is sent to `expiredUrl(String)`. The advantage of this approach is if a user accidentally does not log out, there is no need for an administrator to intervene or wait till their session expires.

Parameters:
  `maxSessionsPreventsLogin` - true to have an error at time of authentication, else false (default)
Returns:
  the `SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>.ConcurrencyControlConfigurer` for further customizations

### sessionRegistry

public SessionManagementConfigurer<H>.ConcurrencyControlConfigurer sessionRegistry(org.springframework.security.core.session.SessionRegistry sessionRegistry)
Controls the `SessionRegistry` implementation used. The default is `SessionRegistryImpl` which is an in memory implementation.

Parameters:
  `sessionRegistry` - the `SessionRegistry` to use
Returns:
  the `SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>.ConcurrencyControlConfigurer` for further customizations

### and

@Deprecated(since="6.1", forRemoval=true) public SessionManagementConfigurer<H> and()
Deprecated, for removal: This API element is subject to removal in a future version.
For removal in 7.0. Use `SessionManagementConfigurer.sessionConcurrency(Customizer)` instead
Used to chain back to the `SessionManagementConfigurer`

Returns:
  the `SessionManagementConfigurer` for further customizations