intermediateSession Management: Timeout, Concurrency & Fixation

What's required to make maximumSessions() work correctly?

You must register an HttpSessionEventPublisher bean (a ServletContextListener) so that Spring Security's SessionRegistry is correctly notified when sessions are destroyed (e.g., via logout or timeout). Without it, the registry loses track of destroyed sessions and can incorrectly count/expire sessions.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to What does SessionCreationPolicy.STATELESS actually do, and when should you use it? →← Back to all Spring Security questions