Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Do Not Invalidate Current Session When It Is Registered

Browse Source 
Closes gh-15066
This commit is contained in:
Joaquin Santana
2024-05-13 17:09:34 +02:00
committed by Marcus Hert Da Coregio
parent e321e5de7c
commit 927840fe88
2 changed files with 44 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
web/src/main/java/org/springframework/security/web/server/authentication/InvalidateLeastUsedServerMaximumSessionsExceededHandler.java
View File

@@ -24,6 +24,7 @@ import reactor.core.publisher.Flux;
import reactor.core.publisher.Mono;
import org.springframework.security.core.session.ReactiveSessionInformation;
import org.springframework.util.Assert;
import org.springframework.web.server.session.WebSessionStore;
/**
@@ -42,12 +43,14 @@ public final class InvalidateLeastUsedServerMaximumSessionsExceededHandler
private final WebSessionStore webSessionStore;
public InvalidateLeastUsedServerMaximumSessionsExceededHandler(WebSessionStore webSessionStore) {
Assert.notNull(webSessionStore, "webSessionStore cannot be null");
this.webSessionStore = webSessionStore;
}
@Override
public Mono<Void> handle(MaximumSessionsContext context) {
List<ReactiveSessionInformation> sessions = new ArrayList<>(context.getSessions());
sessions.removeIf((session) -> session.getSessionId().equals(context.getCurrentSession().getId()));
sessions.sort(Comparator.comparing(ReactiveSessionInformation::getLastAccessTime));
int maximumSessionsExceededBy = sessions.size() - context.getMaximumSessionsAllowed() + 1;
List<ReactiveSessionInformation> leastRecentlyUsedSessionsToInvalidate = sessions.subList(0,