config/src/main/java/org/springframework/security/config/annotation/web/configurers/SessionManagementConfigurer.java
private SessionAuthenticationStrategy getSessionAuthenticationStrategy(H http) {
		if (this.sessionAuthenticationStrategy != null) {
			return this.sessionAuthenticationStrategy;
		}
		List<SessionAuthenticationStrategy> delegateStrategies = this.sessionAuthenticationStrategies;
		SessionAuthenticationStrategy defaultSessionAuthenticationStrategy;
		if (this.providedSessionAuthenticationStrategy == null) {
			// If the user did not provide a SessionAuthenticationStrategy
			// then default to sessionFixationAuthenticationStrategy
			defaultSessionAuthenticationStrategy = postProcess(
					this.sessionFixationAuthenticationStrategy);
		}
		else {
			defaultSessionAuthenticationStrategy = this.providedSessionAuthenticationStrategy;
		}
		if (isConcurrentSessionControlEnabled()) {
			SessionRegistry sessionRegistry = getSessionRegistry(http);
			ConcurrentSessionControlAuthenticationStrategy concurrentSessionControlStrategy = new ConcurrentSessionControlAuthenticationStrategy(
					sessionRegistry);
			concurrentSessionControlStrategy.setMaximumSessions(this.maximumSessions);
			concurrentSessionControlStrategy
					.setExceptionIfMaximumExceeded(this.maxSessionsPreventsLogin);
			concurrentSessionControlStrategy = postProcess(
					concurrentSessionControlStrategy);

			RegisterSessionAuthenticationStrategy registerSessionStrategy = new RegisterSessionAuthenticationStrategy(
					sessionRegistry);
			registerSessionStrategy = postProcess(registerSessionStrategy);

			delegateStrategies.addAll(Arrays.asList(concurrentSessionControlStrategy,
					defaultSessionAuthenticationStrategy, registerSessionStrategy));
		}
		else {
			delegateStrategies.add(defaultSessionAuthenticationStrategy);
		}
		this.sessionAuthenticationStrategy = postProcess(
				new CompositeSessionAuthenticationStrategy(delegateStrategies));
		return this.sessionAuthenticationStrategy;
	}
private SessionAuthenticationStrategy getSessionAuthenticationStrategy(H http) {
		if (this.sessionAuthenticationStrategy != null) {
			return this.sessionAuthenticationStrategy;
		}
		List<SessionAuthenticationStrategy> delegateStrategies = this.sessionAuthenticationStrategies;
		SessionAuthenticationStrategy defaultSessionAuthenticationStrategy;
		if (this.providedSessionAuthenticationStrategy == null) {
			// If the user did not provide a SessionAuthenticationStrategy
			// then default to sessionFixationAuthenticationStrategy
			defaultSessionAuthenticationStrategy = postProcess(
					this.sessionFixationAuthenticationStrategy);
		}
		else {
			defaultSessionAuthenticationStrategy = this.providedSessionAuthenticationStrategy;
		}
		if (isConcurrentSessionControlEnabled()) {
			SessionRegistry sessionRegistry = getSessionRegistry(http);
			ConcurrentSessionControlAuthenticationStrategy concurrentSessionControlStrategy = new ConcurrentSessionControlAuthenticationStrategy(
					sessionRegistry);
			concurrentSessionControlStrategy.setMaximumSessions(this.maximumSessions);
			concurrentSessionControlStrategy
					.setExceptionIfMaximumExceeded(this.maxSessionsPreventsLogin);
			concurrentSessionControlStrategy = postProcess(
					concurrentSessionControlStrategy);

			RegisterSessionAuthenticationStrategy registerSessionStrategy = new RegisterSessionAuthenticationStrategy(
					sessionRegistry);
			registerSessionStrategy = postProcess(registerSessionStrategy);

			delegateStrategies.addAll(Arrays.asList(concurrentSessionControlStrategy,
					defaultSessionAuthenticationStrategy, registerSessionStrategy));
		}
		else {
			delegateStrategies.add(defaultSessionAuthenticationStrategy);
		}
		this.sessionAuthenticationStrategy = postProcess(
				new CompositeSessionAuthenticationStrategy(delegateStrategies));
		return this.sessionAuthenticationStrategy;
	}
private SessionAuthenticationStrategy getSessionAuthenticationStrategy ( H http ) { if ( this . sessionAuthenticationStrategy != null ) { return this . sessionAuthenticationStrategy ; } List < SessionAuthenticationStrategy > delegateStrategies = this . sessionAuthenticationStrategies ; SessionAuthenticationStrategy defaultSessionAuthenticationStrategy ; if ( this . providedSessionAuthenticationStrategy == null ) { // If the user did not provide a SessionAuthenticationStrategy // then default to sessionFixationAuthenticationStrategy defaultSessionAuthenticationStrategy = postProcess ( this . sessionFixationAuthenticationStrategy ) ; } else { defaultSessionAuthenticationStrategy = this . providedSessionAuthenticationStrategy ; } if ( isConcurrentSessionControlEnabled ( ) ) { SessionRegistry sessionRegistry = getSessionRegistry ( http ) ; ConcurrentSessionControlAuthenticationStrategy concurrentSessionControlStrategy = new ConcurrentSessionControlAuthenticationStrategy ( sessionRegistry ) ; concurrentSessionControlStrategy . setMaximumSessions ( this . maximumSessions ) ; concurrentSessionControlStrategy . setExceptionIfMaximumExceeded ( this . maxSessionsPreventsLogin ) ; concurrentSessionControlStrategy = postProcess ( concurrentSessionControlStrategy ) ; RegisterSessionAuthenticationStrategy registerSessionStrategy = new RegisterSessionAuthenticationStrategy ( sessionRegistry ) ; registerSessionStrategy = postProcess ( registerSessionStrategy ) ; delegateStrategies . addAll ( Arrays . asList ( concurrentSessionControlStrategy , defaultSessionAuthenticationStrategy , registerSessionStrategy ) ) ; } else { delegateStrategies . add ( defaultSessionAuthenticationStrategy ) ; } this . sessionAuthenticationStrategy = postProcess ( new CompositeSessionAuthenticationStrategy ( delegateStrategies ) ) ; return this . sessionAuthenticationStrategy ; }
Gets the customized {@link SessionAuthenticationStrategy} if
{@link #sessionAuthenticationStrategy(SessionAuthenticationStrategy)} was
specified. Otherwise creates a default {@link SessionAuthenticationStrategy}.

@return the {@link SessionAuthenticationStrategy} to use
Gets the customized { @link SessionAuthenticationStrategy } if { @link #sessionAuthenticationStrategy ( SessionAuthenticationStrategy ) } was specified . Otherwise creates a default { @link SessionAuthenticationStrategy } .