mirror of
https://github.com/spring-projects/spring-security.git
synced 2025-02-23 23:31:27 +00:00
This fixes two issues introduced by SEC-1229 * SessionRegistry.registerNewSession is invoked twice * SessionRegistry.removeSession is invoked twice (once by the ConcurrentSessionControlStrategy#onSessionChange and once by SessionRegistryImpl#onApplicationEvent). This is not nearly as problematic since the interface states that implementations should be handle removing the session twice. However, as removing twice requires an unnecessary database hit we should only remove sessions once.