Spring Security - failed to login after logout

I want to allow the user to create only one current session. In my case, this only allows the user to create one session, but once the user is logged out, they cannot log in again.

Security config file:

        .and()
    .csrf()
        .and()
    .exceptionHandling()
        .accessDeniedPage("/accessDenied")
        .and()
    .sessionManagement()
        .maximumSessions(1)
        .expiredUrl("/login")
        .maxSessionsPreventsLogin(true)
        .sessionRegistry(sessionRegistry()) ;
}

@Bean
public SessionRegistry sessionRegistry() {
    SessionRegistry sessionRegistry = new SessionRegistryImpl();
    return sessionRegistry;
}

      

Logout Controller:

@RequestMapping(value="/logout", method = RequestMethod.GET)
public String logoutPage (HttpServletRequest request, HttpServletResponse response) {
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    if (auth != null) {    
        new SecurityContextLogoutHandler().logout(request, response, auth);
    }

    return "redirect:/login?logout";
}

      

I tried with invalid and destroying cookie as well, but it doesn't work.

+3


source to share





All Articles