Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-03-01 10:59:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update max sessions docs

Browse Source 
Add WebSessionStore constructor parameter to the handler

Issue gh-6192
This commit is contained in:
Marcus Hert Da Coregio 2024-02-27 13:36:38 -03:00
parent a5ce8ae87f
commit c86fd99c8f
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
docs/modules/ROOT/pages/reactive/authentication/concurrent-sessions-control.adoc
View File

@ -202,13 +202,13 @@ Java::
[source,java,role="primary"] [source,java,role="primary"]
---- ----
@Bean @Bean
SecurityWebFilterChain filterChain(ServerHttpSecurity http) { SecurityWebFilterChain filterChain(ServerHttpSecurity http, DefaultWebSessionManager webSessionManager) {
http http
// ... // ...
.sessionManagement((sessions) -> sessions .sessionManagement((sessions) -> sessions
.concurrentSessions((concurrency) -> concurrency .concurrentSessions((concurrency) -> concurrency
.maximumSessions(SessionLimit.of(1)) .maximumSessions(SessionLimit.of(1))
.maximumSessionsExceededHandler(new PreventLoginMaximumSessionsExceededHandler()) .maximumSessionsExceededHandler(new PreventLoginMaximumSessionsExceededHandler(webSessionManager.getSessionStore()))
) )
); );
return http.build(); return http.build();
@ -225,13 +225,13 @@ Kotlin::
[source,kotlin,role="secondary"] [source,kotlin,role="secondary"]
---- ----
@Bean @Bean
open fun springSecurity(http: ServerHttpSecurity): SecurityWebFilterChain { open fun springSecurity(http: ServerHttpSecurity, webSessionManager: DefaultWebSessionManager): SecurityWebFilterChain {
return http { return http {
// ... // ...
sessionManagement { sessionManagement {
sessionConcurrency { sessionConcurrency {
maximumSessions = SessionLimit.of(1) maximumSessions = SessionLimit.of(1)
maximumSessionsExceededHandler = PreventLoginMaximumSessionsExceededHandler() maximumSessionsExceededHandler = PreventLoginMaximumSessionsExceededHandler(webSessionManager.sessionStore)
} }
} }
} }
@ -380,6 +380,11 @@ public class SessionControl {
---- ----
====== ======
[NOTE]
====
If you are not using the `WebSessionStoreReactiveSessionRegistry` as the implementation, and you want the `WebSession` to be invalidated as well, you will need to use the `WebSessionStore` to retrieve and invalidate the `WebSession`.
====
[[disabling-for-authentication-filters]] [[disabling-for-authentication-filters]]
== Disabling It for Some Authentication Filters == Disabling It for Some Authentication Filters