How does Spring Security handle session management, and what are the options for handling concurrent sessions?

Question

Accepted Answer

Spring Security creates a session upon successful login by default and offers explicit configuration for limiting and controlling concurrent sessions per user, preventing account sharing or stale sessions from lingering.

Key Points:
• maximumSessions(n) caps how many concurrent sessions a single principal may have active at once.
• maxSessionsPreventsLogin(true) blocks a new login once the limit is reached; the default instead expires the oldest session.
• SessionRegistry tracks active sessions and can be queried or used to forcibly expire a specific session.
• Session fixation protection regenerates the session ID at login to prevent hijacking a pre-authentication session ID.
• Invalid or expired session URLs can be configured to redirect users to a friendly page instead of an error.

Example:
A banking app configures maximumSessions(1) with maxSessionsPreventsLogin(false), so logging in on a new device automatically invalidates the session on the old device rather than blocking the new login.

Code Example:

```
http.sessionManagement(session -> session
    .maximumSessions(1)
    .maxSessionsPreventsLogin(false)
    .expiredUrl("/login?expired"));
```

Interview Tip:
A concise interview answer is:

"Spring Security creates a session at login and lets me control concurrency through sessionManagement().maximumSessions(), which caps how many active sessions a user can have and decides whether a new login blocks or the oldest session gets expired. SessionRegistry lets me inspect or force-expire specific sessions if needed."