Session Management & Security

http.sessionManagement(session -> session
    // ALWAYS       — create even when unused; wasteful
    // IF_REQUIRED  — the default, and correct for a web application
    // NEVER        — do not create, but use one that exists
    // STATELESS    — never create or use; correct for a token API
    .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
 
    // A new id on login. Without it, an attacker who plants a known id
    // holds a valid session once the victim authenticates.
    .sessionFixation(SessionFixationConfigurer::changeSessionId)
 
    .maximumSessions(3)
    .maxSessionsPreventsLogin(false)          // newest login wins
    .expiredUrl("/login?expired"));

server:
  servlet:
    session:
      timeout: 30m
      cookie:
        name: SESSION
        http-only: true      # JavaScript cannot read it — XSS cannot steal it
        secure: true         # HTTPS only
        same-site: lax       # not sent on cross-site POST — CSRF protection
        path: /
        max-age: -1          # session cookie: gone when the browser closes

@Component
public class AbsoluteSessionTimeoutFilter extends OncePerRequestFilter {
 
    private static final Duration MAX_LIFETIME = Duration.ofHours(8);
 
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
                                    FilterChain chain) throws ServletException, IOException {
 
        HttpSession session = request.getSession(false);
        if (session != null) {
            Instant created = Instant.ofEpochMilli(session.getCreationTime());
            // The container's timeout is idle-based, so an actively used
            // stolen session never expires. This caps total lifetime.
            if (created.plus(MAX_LIFETIME).isBefore(Instant.now())) {
                session.invalidate();
                SecurityContextHolder.clearContext();
                response.sendRedirect("/login?expired");
                return;
            }
        }
        chain.doFilter(request, response);
    }
}

@Bean
SessionRegistry sessionRegistry() {
    return new SessionRegistryImpl();
}
 
@Bean
HttpSessionEventPublisher httpSessionEventPublisher() {
    // Required, and easy to forget. Without it the registry never learns
    // about destroyed sessions and the count only ever grows.
    return new HttpSessionEventPublisher();
}

@GetMapping("/account/sessions")
public List<SessionView> mySessions(@AuthenticationPrincipal UserDetails user) {
    return sessionRegistry.getAllSessions(user, false).stream()
            .map(info -> new SessionView(info.getSessionId(), info.getLastRequest(),
                                         metadata.deviceFor(info.getSessionId())))
            .toList();
}
 
@DeleteMapping("/account/sessions/{sessionId}")
public void revoke(@PathVariable String sessionId, @AuthenticationPrincipal UserDetails user) {
    sessionRegistry.getAllSessions(user, false).stream()
            .filter(info -> info.getSessionId().equals(sessionId))
            .findFirst()
            .ifPresent(SessionInformation::expireNow);
}

<dependency>
  <groupId>org.springframework.session</groupId>
  <artifactId>spring-session-data-redis</artifactId>
</dependency>

spring:
  session:
    store-type: redis
    timeout: 30m
    redis:
      namespace: 'acme:session'
      flush-mode: on_save
      # Required for concurrent session control and session listing across
      # instances — without it, each instance sees only its own.
      repository-type: indexed

@Transactional
public void changePassword(String userId, String newPassword) {
    User user = users.findById(userId).orElseThrow();
    user.setPasswordHash(encoder.encode(newPassword));
 
    // A password change must end every session, or an attacker who already
    // has one keeps their access despite the reset.
    sessionRepository.findByPrincipalName(user.username())
            .keySet()
            .forEach(sessionRepository::deleteById);
 
    trustedDevices.revokeAllFor(userId);
    notifications.send(user, "Your password was changed and all sessions ended");
}