title: kill server sessions spring
body: <p>I have an application based on spring framework.
  This application allows 2 multiple sessions for each user.</p>
  
  <pre><code>&lt;bean id="concurrencyFilter"
          class="org.springframework.security.web.session.ConcurrentSessionFilter"&gt;
          &lt;property name="sessionRegistry" ref="sessionRegistry" /&gt;
          &lt;property name="expiredUrl" value="/faces/pages/templates/error.xhtml" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="sessionRegistry"
          class="org.springframework.security.core.session.SessionRegistryImpl" /&gt;
  
      &lt;bean id="sas"
          class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy"&gt;
          &lt;constructor-arg&gt;
              &lt;list&gt;
                  &lt;bean
                      class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy"&gt;
                      &lt;constructor-arg ref="sessionRegistry" /&gt;
                      &lt;property name="maximumSessions" value="2" /&gt;
                      &lt;property name="exceptionIfMaximumExceeded" value="true" /&gt;
                  &lt;/bean&gt;
                  &lt;bean
                      class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy"&gt;
                  &lt;/bean&gt;
                  &lt;bean
                      class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy"&gt;
                      &lt;constructor-arg ref="sessionRegistry" /&gt;
                  &lt;/bean&gt;
              &lt;/list&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;
  </code></pre>
  
  <p>I need that when I login with the second session, kill the first session.</p>
  
  <p>I am tried this with expireNow method, but the 2 sessions maintain active.</p>
  
  <pre><code>        authenticate = authenticationManager
                  .authenticate(new UsernamePasswordAuthenticationToken(username, password));
          if (authenticate.isAuthenticated()) {
              SecurityContextHolder.getContext().setAuthentication(authenticate);
              HttpServletRequest httpReq = (HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext()
                      .getRequest();
              HttpServletResponse httpResp = (HttpServletResponse) FacesContext.getCurrentInstance()
                      .getExternalContext().getResponse();
  
              sessionAuthenticationStrategy.onAuthentication(authenticate, httpReq, httpResp);
  
              final Collection&lt;GrantedAuthority&gt; grantedAuthorities = new ArrayList&lt;GrantedAuthority&gt;();
              final org.springframework.security.core.userdetails.User user = new org.springframework.security.core.userdetails.User(
                      username, password, grantedAuthorities);
  
              List&lt;SessionInformation&gt; sessions = sessionRegistry.getAllSessions(user, false);
              if (sessions.size() &gt; 1) {
                  sessionRegistry.getSessionInformation(sessions.get(0).getSessionId()).expireNow();
  
  
  sessionRegistry.removeSessionInformation(sessions.get(0).getSessionId());
                  }
  </code></pre>
  
  <p>How can I make this!</p>
  
  <p>Thank you.</p>