Configuring expired session redirect

Fortunately, there is a simple method for directing users to a friendly page (typically the login page) when they are flagged by concurrent session control—simply specify the expired-url attribute and set it to a valid page in your application. Update your security.xml file as follows:

    //src/main/java/com/packtpub/springsecurity/configuration/SecurityConfig.java

    http.sessionManagement()
    .maximumSessions(1)
     .expiredUrl("/login/form?expired")
    ;

In the case of our application, this will redirect the user to the standard login form. We will then use the query parameter to display a friendly message indicating that we determined that they had multiple active sessions, and should log in again. Update your login.html page to use this parameter to display our message:

    //src/main/resources/templates/login.html

 ...