Concurrent Session Control

Support
1

I have a problem when using jmix.core.session.maximum-sessions-per-user=1. When I log an user in session A successfully, then I log the same user in using session B. Session B show logs that log in successfully, init MainView but immediately redirect to the LoginView, and the session A still be logged out, so both browsers are not logged in, meaning there is no session available for that user. Therefore, I can re-log in at any browser. So my question is how could I log in successfully the new session and log the old session out?
I’m using jmix version 2.6.2. Please help me with this! Thank you guys so much!

Please help Jmix team and community members to answer your questions:

  • Provide your Jmix framework and Studio versions. Use Welcome screen in Studio to copy versions.
  • If possible, attach a zip-archive with a sample project or provide a link to a GitHub repository with a minimal, reproducible example. Use Gradle → Zip Project action in Jmix tool window to make an archive.
  • Format source code in your posts by wrapping it in triple backquotes (```).
4

Here is the better information:
I’m using Jmix 2.6.2 and trying to limit users to a single active session by setting:

jmix.core.session.maximum-sessions-per-user=1

My expected behavior is:

  1. User logs in from Browser A successfully.

  2. The same user logs in from Browser B successfully.

  3. Browser B remains logged in.

  4. Browser A is invalidated and redirected to the login page on the next request.

However, the actual behavior is different:

  1. User logs in from Browser A successfully.

  2. The same user logs in from Browser B.

  3. Browser B authenticates successfully (I can see the login success flow and MainView initialization in the logs).

  4. Immediately after that, Browser B is redirected back to the LoginView.

  5. Browser A is also logged out.

  6. As a result, neither Browser A nor Browser B remains authenticated, and the user can log in again from either browser.

It seems that when the second login occurs, both sessions become invalid instead of keeping the newest session and expiring the older one.

Is this the expected behavior of jmix.core.session.maximum-sessions-per-user=1 in Jmix 2.6.2, or could this be a bug/configuration issue?

Has anyone successfully implemented the following behavior in Jmix?

  • New login succeeds.

  • Old session is expired.

  • The old session is redirected to the login page on the next request.

For easier investigation, I have attached:

Thank you very much for your help.

5

Hi,

I’ve been able to reproduce the problem and created a GitHub issue. Currently, I’m investigating a workaround to apply to your project.

Regards,
Gleb

7

As a workaround add the following to the application.properties:

jmix.core.exclude-beans=sessionControlAuthenticationStrategy

and register a new sessionControlAuthenticationStrategy bean in the configuration class:

@Bean("demo_sessionControlAuthenticationStrategy")
@Primary
public SessionAuthenticationStrategy sessionControlAuthenticationStrategy(SessionRegistry sessionRegistry,
                                                                          SessionProperties sessionProperties) {
    ConcurrentSessionControlAuthenticationStrategy concurrentSessionControlStrategy =
            new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry);
    concurrentSessionControlStrategy.setMaximumSessions(sessionProperties.getMaximumSessionsPerUser());

    RegisterSessionAuthenticationStrategy registerSessionStrategy =
            new RegisterSessionAuthenticationStrategy(sessionRegistry);

    return new CompositeSessionAuthenticationStrategy(
            List.of(concurrentSessionControlStrategy, registerSessionStrategy));
}

Regards,
Gleb