Concurrent session control uses o.s.s.core.session.SessionRegistry to maintain a list of active HTTP sessions and the authenticated users with which they are associated. As sessions are created and expired, the registry is updated in real time based on the session life cycle events published by HttpSessionEventPublisher to track the number of active sessions per authenticated user.
Refer to the following diagram:
An extension of SessionAuthenticationStrategy, o.s.s.web.authentication.session.ConcurrentSessionControlStrategy is the method by which new sessions are tracked and the method by which concurrency ...
