{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/1537","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/1537/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/1537/comments","events_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/1537/events","html_url":"https://github.com/spring-projects/spring-boot/issues/1537","id":42372406,"number":1537,"title":"Missing example with Spring Security maximum sessions feature","user":{"login":"arnaldop","id":6642062,"avatar_url":"https://avatars.githubusercontent.com/u/6642062?v=3","gravatar_id":"","url":"https://api.github.com/users/arnaldop","html_url":"https://github.com/arnaldop","followers_url":"https://api.github.com/users/arnaldop/followers","following_url":"https://api.github.com/users/arnaldop/following{/other_user}","gists_url":"https://api.github.com/users/arnaldop/gists{/gist_id}","starred_url":"https://api.github.com/users/arnaldop/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arnaldop/subscriptions","organizations_url":"https://api.github.com/users/arnaldop/orgs","repos_url":"https://api.github.com/users/arnaldop/repos","events_url":"https://api.github.com/users/arnaldop/events{/privacy}","received_events_url":"https://api.github.com/users/arnaldop/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spring-projects/spring-boot/labels/question","name":"question","color":"cc317c"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2014-09-10T02:37:05Z","updated_at":"2015-06-08T16:16:41Z","closed_at":"2015-02-21T05:40:39Z","body":"There is no example to illustrate session management with maximum sessions.\r\n\r\nThe java code is:\r\n\r\n                .sessionManagement()\r\n                    .maximumSessions(1)\r\n                    .maxSessionsPreventsLogin(false)\r\n                    .expiredUrl(\"/login?expired\")\r\n\r\nbut logout does not invalidate the login.\r\n\r\nThere are some forums that mention org.springframework.security.web.session.HttpSessionEventPublisher, but it's supposed to be added to web.xml, which Spring Boot doesn't use.\r\n\r\nI can't piece it together into code that successfully logs the user out and allows for a new login."},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/comments/110060274","html_url":"https://github.com/spring-projects/spring-boot/issues/1537#issuecomment-110060274","issue_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/1537","id":110060274,"user":{"login":"cristiandley","id":1873659,"avatar_url":"https://avatars.githubusercontent.com/u/1873659?v=3","gravatar_id":"","url":"https://api.github.com/users/cristiandley","html_url":"https://github.com/cristiandley","followers_url":"https://api.github.com/users/cristiandley/followers","following_url":"https://api.github.com/users/cristiandley/following{/other_user}","gists_url":"https://api.github.com/users/cristiandley/gists{/gist_id}","starred_url":"https://api.github.com/users/cristiandley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cristiandley/subscriptions","organizations_url":"https://api.github.com/users/cristiandley/orgs","repos_url":"https://api.github.com/users/cristiandley/repos","events_url":"https://api.github.com/users/cristiandley/events{/privacy}","received_events_url":"https://api.github.com/users/cristiandley/received_events","type":"User","site_admin":false},"created_at":"2015-06-08T16:16:41Z","updated_at":"2015-06-08T16:16:41Z","body":"I keep having the same issue... if i click \"logout\", angular actually redirects to my \"/\" but quickly returns to \"/home\" :(\r\n\r\nSeems that the session still valid\r\n\r\nThis is my code now:\r\n\r\n```java\r\nhttp\r\n\t\t\t\t.authorizeRequests()\r\n\t\t\t\t.antMatchers(\"/**\")\r\n\t\t\t\t.permitAll().anyRequest().authenticated()\r\n\t\t\t.and()\r\n\t\t\t\t.logout()\r\n\t\t\t\t.logoutRequestMatcher(new AntPathRequestMatcher(\"/logout\"))\r\n\t\t\t\t.logoutSuccessUrl(\"/\")\r\n\t\t\t\t.permitAll()\r\n\t\t\t.and()\r\n\t\t\t\t.csrf().csrfTokenRepository(csrfTokenRepository())\r\n\t\t\t.and()\r\n\t\t\t\t.sessionManagement()\r\n                .maximumSessions(1)\r\n                .expiredUrl(\"/expired\")\r\n                .maxSessionsPreventsLogin(true)\r\n                .sessionRegistry(sessionRegistry());\r\n````\r\n"}}