For the latest stable version, please use Spring Session 3.1.7! |
Spring Security Integration
Spring Session provides integration with Spring Security.
Spring Security Remember-me Support
Spring Session provides integration with Spring Security’s Remember-me Authentication. The support:
-
Changes the session expiration length
-
Ensures that the session cookie expires at
Integer.MAX_VALUE
. The cookie expiration is set to the largest possible value, because the cookie is set only when the session is created. If it were set to the same value as the session expiration, the session would get renewed when the user used it but the cookie expiration would not be updated (causing the expiration to be fixed).
To configure Spring Session with Spring Security in Java Configuration, you can use the following listing as a guide:
@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http
// ... additional configuration ...
.rememberMe((rememberMe) -> rememberMe
.rememberMeServices(rememberMeServices())
);
}
@Bean
public SpringSessionRememberMeServices rememberMeServices() {
SpringSessionRememberMeServices rememberMeServices =
new SpringSessionRememberMeServices();
// optionally customize
rememberMeServices.setAlwaysRemember(true);
return rememberMeServices;
}
An XML-based configuration would look something like the following:
<security:http>
<!-- ... -->
<security:form-login />
<security:remember-me services-ref="rememberMeServices"/>
<security:intercept-url pattern="/**" access="permitAll()"/>
</security:http>
<bean id="rememberMeServices"
class="org.springframework.session.security.web.authentication.SpringSessionRememberMeServices"
p:alwaysRemember="true"/>
Spring Security Concurrent Session Control
Spring Session provides integration with Spring Security to support its concurrent session control.
This allows limiting the number of active sessions that a single user can have concurrently, but, unlike the default
Spring Security support, this also works in a clustered environment. This is done by providing a custom
implementation of Spring Security’s SessionRegistry
interface.
When using Spring Security’s Java config DSL, you can configure the custom SessionRegistry
through the
SessionManagementConfigurer
, as the following listing shows:
@Configuration
public class SecurityConfiguration<S extends Session> {
@Autowired
private FindByIndexNameSessionRepository<S> sessionRepository;
@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
return http
// other config goes here...
.sessionManagement((sessionManagement) -> sessionManagement
.maximumSessions(2)
.sessionRegistry(sessionRegistry())
)
.build();
}
@Bean
public SpringSessionBackedSessionRegistry<S> sessionRegistry() {
return new SpringSessionBackedSessionRegistry<>(this.sessionRepository);
}
}
This assumes that you have also configured Spring Session to provide a FindByIndexNameSessionRepository
that
returns Session
instances.
When using XML configuration, it would look something like the following listing:
<security:http>
<!-- other config goes here... -->
<security:session-management>
<security:concurrency-control max-sessions="2" session-registry-ref="sessionRegistry"/>
</security:session-management>
</security:http>
<bean id="sessionRegistry"
class="org.springframework.session.security.SpringSessionBackedSessionRegistry">
<constructor-arg ref="sessionRepository"/>
</bean>
This assumes that your Spring Session SessionRegistry
bean is called sessionRegistry
, which is the name used by all
SpringHttpSessionConfiguration
subclasses.
Limitations
Spring Session’s implementation of Spring Security’s SessionRegistry
interface does not support the getAllPrincipals
method, as this information cannot be retrieved by using Spring Session. This method is never called by Spring Security,
so this affects only applications that access the SessionRegistry
themselves.