Session Management

This chapter discusses Spring Security's session management functionality. It starts off with an example of how Spring Security defends against session fixation. We will then discuss how concurrency control can be leveraged to restrict access to software licensed on a per-user basis. We will also see how session management can be leveraged for administrative functions. Last, we will explore how HttpSession is used in Spring Security and how we can control its creation.

The following is a list of topics that will be covered in this chapter:

• Session management/session fixation
• Concurrency control
• Managing logged in users
• How HttpSession is used in Spring Security and how to control creation
• How to use the DebugFilter class to discover where HttpSession was created

Configuring session fixation protection

As we are using the security namespace style of configuration, session fixation protection is already configured on our behalf. If we wanted to explicitly configure it to mirror the default settings, we would do the following:

    http.sessionManagement()
    .sessionFixation().migrateSession();

Session fixation protection is a feature of the framework that you most likely won't even notice unless you try to act as a malicious user. We'll show you how to simulate a session-stealing attack; before we do, it's important to understand what session fixation does and the type of attack it prevents.

Understanding session fixation attacks

Session fixation is a type of attack whereby...

Restricting the number of concurrent sessions per user

In the software industry, software is often sold on a per-user basis. This means that, as software developers, we have an interest in ensuring that only a single session per user exists, to combat the sharing of accounts. Spring Security's concurrent session control ensures that a single user cannot have more than a fixed number of active sessions simultaneously (typically one). Ensuring that this maximum limit is enforced involves several components working in tandem to accurately track changes in user session activity.

Let's configure the feature, review how it works, and then test it out!

Configuring concurrent session control

Now that we have understood the...

Configuring expired session redirect

Fortunately, there is a simple method for directing users to a friendly page (typically the login page) when they are flagged by concurrent session control—simply specify the expired-url attribute and set it to a valid page in your application. Update your security.xml file as follows:

    //src/main/java/com/packtpub/springsecurity/configuration/SecurityConfig.java

    http.sessionManagement()
    .maximumSessions(1)
     .expiredUrl("/login/form?expired")
    ;

In the case of our application, this will redirect the user to the standard login form. We will then use the query parameter to display a friendly message indicating that we determined that they had multiple active sessions, and should log in again. Update your login.html page to use this parameter to display our message:

    //src/main/resources/templates/login.html

 ...

Common problems with concurrency control

There are a few common reasons that logging in with the same user does not trigger a logout event. The first occurs when using custom UserDetails (as we did in Chapter 3, Custom Authentication) while the equals and hashCode methods are not properly implemented. This occurs because the default SessionRegistry implementation uses an in-memory map to store UserDetails. In order to resolve this, you must ensure that you have properly implemented the hashCode and equals methods.

The second problem occurs when restarting the application container while the user sessions are persisted to a disk. When the container has started back up, the users who were already logged in with a valid session are logged in. However, the in-memory map of SessionRegistry that is used to determine if the user is already logged in will be empty. This means that Spring...

Other benefits of concurrent session control

Another benefit of concurrent session control is that SessionRegistry exists to track active (and, optionally, expired) sessions. This means that we can get runtime information about what user activity exists in our system (for authenticated users, at least) by performing the following steps:

1. You can even do this if you don't want to enable concurrent session control. Simply set maximumSessions to -1, and session tracking will remain enabled, even though no maximum will be enforced. Instead, we will use the explicit bean configuration provided in the SessionConfig.java file of this chapter, as follows:

        //src/main/java/com/packtpub/springsecurity/configuration/
        SessionConfig.java

        @Bean
        public SessionRegistry sessionRegistry(){
         return new SessionRegistryImpl();
        }

2. We have already added...

Displaying active sessions for a user

You've probably seen how many websites allow a user to view and forcibly log out sessions for their account. We can easily use this forcible logout functionality to do the same. We have already provided UserSessionController, which obtains the active sessions for the currently logged in user. You can see the implementation as follows:

    //src/main/java/com/packtpub/springsecurity/web/controllers/
    UserSessionController.java

    @Controller
    public class UserSessionController {
     private final SessionRegistry sessionRegistry;
    @Autowired
     public UserSessionController(SessionRegistry sessionRegistry) {
      this.sessionRegistry = sessionRegistry;
    }
      @GetMapping("/user/sessions/")
    public String sessions(Authentication authentication, ModelMap model) {
    List<SessionInformation> sessions = sessionRegistry...

Summary

After reading this chapter, you should be familiar with how Spring Security manages sessions and protects against session fixation attacks. We also know how to use Spring Security's concurrency control to prevent the same user from being authenticated multiple times.

We also explored the utilization of concurrency control to allow a user to terminate sessions associated with their account. Also, we saw how to configure Spring Security's creation of sessions. We also covered how to use Spring Security's DebugFilter filter to troubleshoot issues related to Spring.

We also learned about security, including determining when a HttpSession method was created and what caused it to be created.

This concludes our discussion about Spring Security's session management. In the next chapter, we will discuss some specifics about integrating Spring Security with other...