Spring Security allows you to manage sessions on your server with only some configuration. Some of the most important session management activities are listed here:
- Session creation: This decides when a session needs to be created and the ways in which you can interact with it. In the Spring Security configuration, put in the following code:
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.ALWAYS);
There are four session creation policies that you can choose from. They are as follows:
ALWAYS: Always create a session if it doesn't exist.IF_REQUIRED: If required, a session is created.NEVER: This will never create a session; rather, it will use the session if it exists.STATELESS: No session will be created nor used.invalidSession: This controls how the user is intimated if the server sees an invalid session:
http.sessionManagement().invalidSessionUrl("/invalidSession");- Session timeout: This controls how the user is intimated if the session has expired.
- Concurrent...