java - Deny log in with already authenticated session -

how can deny second log in (with same or different user) authenticated http session?

for form-login found following work-arounds:

• redirect in controller

• redirect in view

• restrict login page

but these work-arounds not perfect, because can still access login-processing-url , execute second log in. problem authentication mechanisms without login page, http basic authentication , kerberos.

my java configuration:

@configuration @enablewebsecurity public static class mywebsecurityconfigurationadapter extends websecurityconfigureradapter {      protected void configure(httpsecurity http) throws exception {         http             .authorizerequests()                 .antmatchers("/**").hasauthority("role_user")                 .and()             .formlogin()                 .loginprocessingurl("/login").permitall()                 .loginpage("/index.jsp").permitall()                 .defaultsuccessurl("start.jsp")                 .failureurl("/index.jsp")                 .and()             .httpbasic();     } } 

example:

1. user a: logs in http basic authentication.
2. system: creates session , returns session cookie.
3. user b: logs in http basic authentication on same machine , sends session cookie.
4. system: creates new session, merges values old session new session (see sessionfixationprotectionstrategy), destroys old session , returns new session cookie.

put following entry in web.xml

<listener>   <listener-class>org.springframework.security.web.session.httpsessioneventpublisher</listener-class> </listener> 

and in spring security config, use following snippet:

<http>   <session-management>     <concurrency-control max-sessions="1" expired-url="/redirect-page" />   </session-management> </http>