Package org.springframework.security.web.session

# Class ConcurrentSessionFilter

java.lang.Object
org.springframework.web.filter.GenericFilterBean
org.springframework.security.web.session.ConcurrentSessionFilter

All Implemented Interfaces:
  `jakarta.servlet.Filter`, `org.springframework.beans.factory.Aware`, `org.springframework.beans.factory.BeanNameAware`, `org.springframework.beans.factory.DisposableBean`, `org.springframework.beans.factory.InitializingBean`, `org.springframework.context.EnvironmentAware`, `org.springframework.core.env.EnvironmentCapable`, `org.springframework.web.context.ServletContextAware`

public class ConcurrentSessionFilter extends org.springframework.web.filter.GenericFilterBean
Filter required by concurrent session handling package.

This filter performs two functions. First, it calls `SessionRegistry.refreshLastRequest(String)` for each request so that registered sessions always have a correct "last update" date/time. Second, it retrieves a `SessionInformation` from the `SessionRegistry` for each request and checks if the session has been marked as expired. If it has been marked as expired, the configured logout handlers will be called (as happens with `LogoutFilter`), typically to invalidate the session. To handle the expired session a call to the `SessionInformationExpiredStrategy` is made. The session invalidation will cause an `HttpSessionDestroyedEvent` to be published via the `HttpSessionEventPublisher` registered in `web.xml`.

## Field Summary

### Fields inherited from class org.springframework.web.filter.GenericFilterBean

`logger`

## Constructor Summary

Constructors
Constructor
Description
`ConcurrentSessionFilter(org.springframework.security.core.session.SessionRegistry sessionRegistry)`
`ConcurrentSessionFilter(org.springframework.security.core.session.SessionRegistry sessionRegistry, String expiredUrl)`
Deprecated.
use `ConcurrentSessionFilter(SessionRegistry, SessionInformationExpiredStrategy)` with `SimpleRedirectSessionInformationExpiredStrategy` instead.
`ConcurrentSessionFilter(org.springframework.security.core.session.SessionRegistry sessionRegistry, SessionInformationExpiredStrategy sessionInformationExpiredStrategy)`

## Method Summary

Modifier and Type
Method
Description
`void`
`afterPropertiesSet()`
`protected String`
`determineExpiredUrl(jakarta.servlet.http.HttpServletRequest request, org.springframework.security.core.session.SessionInformation info)`
Deprecated.
Use `ConcurrentSessionFilter(SessionRegistry, SessionInformationExpiredStrategy)` instead.
`void`
`doFilter(jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response, jakarta.servlet.FilterChain chain)`
`void`
`setLogoutHandlers(List<LogoutHandler> handlers)`
Set list of `LogoutHandler`
`void`
`setLogoutHandlers(LogoutHandler[] handlers)`
`void`
`setRedirectStrategy(RedirectStrategy redirectStrategy)`
Deprecated.
use `ConcurrentSessionFilter(SessionRegistry, SessionInformationExpiredStrategy)` instead.
`void`
`setSecurityContextHolderStrategy(org.springframework.security.core.context.SecurityContextHolderStrategy securityContextHolderStrategy)`
Sets the `SecurityContextHolderStrategy` to use.

### Methods inherited from class org.springframework.web.filter.GenericFilterBean

`addRequiredProperty, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Constructor Details

### ConcurrentSessionFilter

public ConcurrentSessionFilter(org.springframework.security.core.session.SessionRegistry sessionRegistry)

### ConcurrentSessionFilter

@Deprecated public ConcurrentSessionFilter(org.springframework.security.core.session.SessionRegistry sessionRegistry, String expiredUrl)
Deprecated.
use `ConcurrentSessionFilter(SessionRegistry, SessionInformationExpiredStrategy)` with `SimpleRedirectSessionInformationExpiredStrategy` instead.
Creates a new instance

Parameters:
  `sessionRegistry` - the SessionRegistry to use
  `expiredUrl` - the URL to redirect to

### ConcurrentSessionFilter

public ConcurrentSessionFilter(org.springframework.security.core.session.SessionRegistry sessionRegistry, SessionInformationExpiredStrategy sessionInformationExpiredStrategy)

## Method Details

### afterPropertiesSet

public void afterPropertiesSet()

Specified by:
  `afterPropertiesSet` in interface `org.springframework.beans.factory.InitializingBean`
Overrides:
  `afterPropertiesSet` in class `org.springframework.web.filter.GenericFilterBean`

### doFilter

public void doFilter(jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response, jakarta.servlet.FilterChain chain) throws IOException, jakarta.servlet.ServletException

Throws:
  `IOException`
  `jakarta.servlet.ServletException`

### determineExpiredUrl

@Deprecated protected String determineExpiredUrl(jakarta.servlet.http.HttpServletRequest request, org.springframework.security.core.session.SessionInformation info)
Deprecated.
Use `ConcurrentSessionFilter(SessionRegistry, SessionInformationExpiredStrategy)` instead.
Determine the URL for expiration

Parameters:
  `request` - the HttpServletRequest
  `info` - the `SessionInformation`
Returns:
  the URL for expiration

### setSecurityContextHolderStrategy

public void setSecurityContextHolderStrategy(org.springframework.security.core.context.SecurityContextHolderStrategy securityContextHolderStrategy)
Sets the `SecurityContextHolderStrategy` to use. The default action is to use the `SecurityContextHolderStrategy` stored in `SecurityContextHolder`.

Since:
  5.8

### setLogoutHandlers

public void setLogoutHandlers(LogoutHandler[] handlers)

### setLogoutHandlers

public void setLogoutHandlers(List<LogoutHandler> handlers)
Set list of `LogoutHandler`

Parameters:
  `handlers` - list of `LogoutHandler`
Since:
  5.2.0

### setRedirectStrategy

@Deprecated public void setRedirectStrategy(RedirectStrategy redirectStrategy)
Deprecated.
use `ConcurrentSessionFilter(SessionRegistry, SessionInformationExpiredStrategy)` instead.
Sets the `RedirectStrategy` used with `ConcurrentSessionFilter(SessionRegistry, String)`

Parameters:
  `redirectStrategy` - the `RedirectStrategy` to use