Session management

Spring Security allows you to manage sessions on your server with only some configuration. Some of the most important session management activities are listed here:

• Session creation: This decides when a session needs to be created and the ways in which you can interact with it. In the Spring Security configuration, put in the following code:

http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.ALWAYS);

There are four session creation policies that you can choose from. They are as follows:

• • ALWAYS: Always create a session if it doesn't exist.
  • IF_REQUIRED: If required, a session is created.
  • NEVER: This will never create a session; rather, it will use the session if it exists.
  • STATELESS: No session will be created nor used.
  • invalidSession: This controls how the user is intimated if the server sees an invalid session:

http.sessionManagement().invalidSessionUrl("/invalidSession");

• Session timeout: This controls how the user is intimated if the session has expired.
• Concurrent...