diff --git a/core/src/main/java/org/springframework/security/concurrent/ConcurrentSessionFilter.java b/core/src/main/java/org/springframework/security/concurrent/ConcurrentSessionFilter.java index 062079d97f..db0d9b1b7b 100644 --- a/core/src/main/java/org/springframework/security/concurrent/ConcurrentSessionFilter.java +++ b/core/src/main/java/org/springframework/security/concurrent/ConcurrentSessionFilter.java @@ -15,9 +15,13 @@ package org.springframework.security.concurrent; -import org.springframework.beans.factory.InitializingBean; +import org.springframework.security.Authentication; +import org.springframework.security.context.SecurityContextHolder; import org.springframework.security.ui.FilterChainOrderUtils; import org.springframework.security.ui.SpringSecurityFilter; +import org.springframework.security.ui.logout.LogoutHandler; +import org.springframework.security.ui.logout.SecurityContextLogoutHandler; +import org.springframework.beans.factory.InitializingBean; import org.springframework.util.Assert; import javax.servlet.FilterChain; @@ -30,13 +34,15 @@ import java.io.IOException; /** * Filter required by concurrent session handling package. - *
This filter performs two functions. First, it calls - * {@link org.springframework.security.concurrent.SessionRegistry#refreshLastRequest(String)} for each request. - * That way, registered sessions always have a correct "last update" date/time. Second, it retrieves + *
+ * This filter performs two functions. First, it calls
+ * {@link org.springframework.security.concurrent.SessionRegistry#refreshLastRequest(String)} for each request
+ * so that registered sessions always have a correct "last update" date/time. Second, it retrieves a
* {@link org.springframework.security.concurrent.SessionInformation} from the SessionRegistry
* for each request and checks if the session has been marked as expired.
- * If it has been marked as expired, the session is invalidated. The invalidation of the session will also cause the
- * request to redirect to the URL specified, and a
+ * If it has been marked as expired, the configured logout handlers will be called (as happens with
+ * {@link org.springframework.security.ui.logout.LogoutFilter}), typically to invalidate the session.
+ * A redirect to the expiredURL specified will be performed, and the session invalidation will cause an
* {@link org.springframework.security.ui.session.HttpSessionDestroyedEvent} to be published via the
* {@link org.springframework.security.ui.session.HttpSessionEventPublisher} registered in web.xml.