From 5b2fd4d01393915ef1fb39ab89f8e65ffe081d5d Mon Sep 17 00:00:00 2001
From: eugenp <hanriseldon@gmail.com>
Date: Sun, 11 Aug 2013 15:29:10 +0300
Subject: [PATCH] new session work

---
 .../src/main/java/org/baeldung/spring/MvcConfig.java |  2 ++
 .../src/main/resources/webSecurityConfig.xml         | 12 ++++++++----
 .../src/main/webapp/WEB-INF/web.xml                  |  3 +++
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/spring-security-mvc-session/src/main/java/org/baeldung/spring/MvcConfig.java b/spring-security-mvc-session/src/main/java/org/baeldung/spring/MvcConfig.java
index 2229516633..9e9c240181 100644
--- a/spring-security-mvc-session/src/main/java/org/baeldung/spring/MvcConfig.java
+++ b/spring-security-mvc-session/src/main/java/org/baeldung/spring/MvcConfig.java
@@ -27,6 +27,8 @@ public class MvcConfig extends WebMvcConfigurerAdapter {
 
         registry.addViewController("/login.html");
         registry.addViewController("/homepage.html");
+        registry.addViewController("/sessionExpired.html");
+        registry.addViewController("/invalidExpired.html");
         registry.addViewController("/console.html");
     }
 
diff --git a/spring-security-mvc-session/src/main/resources/webSecurityConfig.xml b/spring-security-mvc-session/src/main/resources/webSecurityConfig.xml
index 186a435cdb..38348cb6ff 100644
--- a/spring-security-mvc-session/src/main/resources/webSecurityConfig.xml
+++ b/spring-security-mvc-session/src/main/resources/webSecurityConfig.xml
@@ -6,7 +6,7 @@
 		http://www.springframework.org/schema/beans 
         http://www.springframework.org/schema/beans/spring-beans-3.2.xsd">
 
-    <http use-expressions="true">
+    <http create-session="always" use-expressions="true">
         <intercept-url pattern="/anonymous*" access="isAnonymous()" />
         <intercept-url pattern="/login*" access="permitAll" />
         <intercept-url pattern="/**" access="isAuthenticated()" />
@@ -14,9 +14,13 @@
         <form-login login-page='/login.html' authentication-success-handler-ref="myAuthenticationSuccessHandler" authentication-failure-url="/login.html?error=true" />
 
         <logout delete-cookies="JSESSIONID" />
-		
-		<remember-me key="uniqueAndSecret" token-validity-seconds="86400"/>
-		
+
+        <remember-me key="uniqueAndSecret" token-validity-seconds="86400" />
+
+        <session-management>
+            <concurrency-control max-sessions="2" />
+        </session-management>
+
     </http>
 
     <beans:bean id="myAuthenticationSuccessHandler" class="org.baeldung.security.MySimpleUrlAuthenticationSuccessHandler" />
diff --git a/spring-security-mvc-session/src/main/webapp/WEB-INF/web.xml b/spring-security-mvc-session/src/main/webapp/WEB-INF/web.xml
index 2dc303f7ae..a807f7dc07 100644
--- a/spring-security-mvc-session/src/main/webapp/WEB-INF/web.xml
+++ b/spring-security-mvc-session/src/main/webapp/WEB-INF/web.xml
@@ -12,6 +12,9 @@
     <listener>
         <listener-class>org.baeldung.web.SessionListenerWithMetrics</listener-class>
     </listener>
+    <listener>
+        <listener-class>org.springframework.security.ui.session.HttpSessionEventPublisher</listener-class>
+    </listener>
 
     <!-- Spring root -->
     <context-param>