What's required to make maximumSessions() work correctly?

You must register an HttpSessionEventPublisher bean (a ServletContextListener) so that Spring Security's SessionRegistry is correctly notified when sessions are destroyed (e.g., via logout or timeout). Without it, the registry loses track of destroyed sessions and can incorrectly count/expire sessions.