web/src/main/java/org/springframework/security/web/authentication/session/ConcurrentSessionControlAuthenticationStrategy.java
public void onAuthentication(Authentication authentication,
			HttpServletRequest request, HttpServletResponse response) {

		final List<SessionInformation> sessions = sessionRegistry.getAllSessions(
				authentication.getPrincipal(), false);

		int sessionCount = sessions.size();
		int allowedSessions = getMaximumSessionsForThisUser(authentication);

		if (sessionCount < allowedSessions) {
			// They haven't got too many login sessions running at present
			return;
		}

		if (allowedSessions == -1) {
			// We permit unlimited logins
			return;
		}

		if (sessionCount == allowedSessions) {
			HttpSession session = request.getSession(false);

			if (session != null) {
				// Only permit it though if this request is associated with one of the
				// already registered sessions
				for (SessionInformation si : sessions) {
					if (si.getSessionId().equals(session.getId())) {
						return;
					}
				}
			}
			// If the session is null, a new one will be created by the parent class,
			// exceeding the allowed number
		}

		allowableSessionsExceeded(sessions, allowedSessions, sessionRegistry);
	}
public void onAuthentication(Authentication authentication,
			HttpServletRequest request, HttpServletResponse response) {

		final List<SessionInformation> sessions = sessionRegistry.getAllSessions(
				authentication.getPrincipal(), false);

		int sessionCount = sessions.size();
		int allowedSessions = getMaximumSessionsForThisUser(authentication);

		if (sessionCount < allowedSessions) {
			// They haven't got too many login sessions running at present
			return;
		}

		if (allowedSessions == -1) {
			// We permit unlimited logins
			return;
		}

		if (sessionCount == allowedSessions) {
			HttpSession session = request.getSession(false);

			if (session != null) {
				// Only permit it though if this request is associated with one of the
				// already registered sessions
				for (SessionInformation si : sessions) {
					if (si.getSessionId().equals(session.getId())) {
						return;
					}
				}
			}
			// If the session is null, a new one will be created by the parent class,
			// exceeding the allowed number
		}

		allowableSessionsExceeded(sessions, allowedSessions, sessionRegistry);
	}
public void onAuthentication ( Authentication authentication , HttpServletRequest request , HttpServletResponse response ) { final List < SessionInformation > sessions = sessionRegistry . getAllSessions ( authentication . getPrincipal ( ) , false ) ; int sessionCount = sessions . size ( ) ; int allowedSessions = getMaximumSessionsForThisUser ( authentication ) ; if ( sessionCount < allowedSessions ) { // They haven't got too many login sessions running at present return ; } if ( allowedSessions == - 1 ) { // We permit unlimited logins return ; } if ( sessionCount == allowedSessions ) { HttpSession session = request . getSession ( false ) ; if ( session != null ) { // Only permit it though if this request is associated with one of the // already registered sessions for ( SessionInformation si : sessions ) { if ( si . getSessionId ( ) . equals ( session . getId ( ) ) ) { return ; } } } // If the session is null, a new one will be created by the parent class, // exceeding the allowed number } allowableSessionsExceeded ( sessions , allowedSessions , sessionRegistry ) ; }
In addition to the steps from the superclass, the sessionRegistry will be updated
with the new session information.
In addition to the steps from the superclass the sessionRegistry will be updated with the new session information .