I have spring boot application that runs in 4 instances. I used 1 Redis as centralized session management. Currently, the session was successfully stored in Redis. In my custom WebSecurityConfigurerAdapter
I set the following by overriding configure
function.
....
@Bean
public SessionRegistry sessionRegistry() {
return new SessionRegistryImpl();
}
However, this configuration only works in single instance (by using normal and incognito mode). When, I accessed different instances (for example instance A and B) with same credential, the sessions were appended and none of them was invalidated. I followed some post by changing the bean of sessionRegistry
@Autowired
private FindByIndexNameSessionRepository<? extends Session> sessionRepository;
@Bean
public SessionRegistry sessionRegistry() {
return new SpringSessionBackedSessionRegistry<>(sessionRepository);
}
Instead of the app runs, I got an exception regarding bean creation of sessionRegistry.
Anyone has a suggestion to achieve how to ensure 1 user have only 1 active session? Thank you