anchor.diff:  </session-management>
   </http>
   ----
  +====
  +
   
   This will prevent a user from logging in multiple times - a second login will cause the first to be invalidated.
   Often you would prefer to prevent a second login, in which case you can use
   
  -[source,xml]
  -----
  -<http>
  -...
  +====
  +.Java
  +[source,java,role="primary"]
  +----
  +@Override
  +protected void configure(HttpSecurity http) throws Exception {
  +    http
  +        .sessionManagement(session -> session
  +            .maximumSessions(1)
  +            .maxSessionsPreventsLogin(true)
  +        );
  +}
  +----
  +
  +.XML
  +[source,xml,role="secondary"]
  +----
  +<http>
   <session-management>
   	<concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
   </session-management>
   </http>
   ----
  +====
  +
   
   The second login will then be rejected.
   By "rejected", we mean that the user will be sent to the `authentication-failure-url` if form-based login is being used.
  
positive.code: [[ns-concurrent-sessions]]
  === Concurrent Session Control
  If you wish to place constraints on a single user's ability to log in to your application, Spring Security supports this out of the box with the following simple additions.
  First you need to add the following listener to your `web.xml` file to keep Spring Security updated about session lifecycle events:
  
  [source,xml]
  ----
  <listener>
  <listener-class>
  
negative.code: </listener-class>
  </listener>
  ----
  ====
  
  Then add the following lines to your application context:
  
  ====
  .Java
  [source,java,role="primary"]
  ----
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http
          .sessionManagement(session -> session
              .maximumSessions(1)
          );
  }
  ----
  
  .XML
  [source,xml,role="secondary"]
  ----
  <http>
  ...
  