I’ve configured Spring Security as shown below:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

    // CSRF settings
    http.csrf((csrf) -> csrf.disable());

    http.sessionManagement(
            (sessionManagement) -> sessionManagement
                    .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
                    .maximumSessions(1)
                    .maxSessionsPreventsLogin(false)
                    .sessionRegistry(sessionRegistry())
    );

    http.authorizeHttpRequests((authorizeHttpRequests) ->
            authorizeHttpRequests
                    .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()
                    .requestMatchers("/").permitAll()
                    .anyRequest().authenticated()
    );

    http.oauth2Login((oauth2Login) ->
            oauth2Login
                    .loginPage("/login")
                    .userInfoEndpoint(userInfoEndpoint -> userInfoEndpoint
                            .userService(principalOauth2UserService))
                    .defaultSuccessUrl("/", true)
                    .permitAll()
    );


    return http.build();
}

I am working on building a service that exclusively uses OAuth 2.0 for authentication.

When a user logs in using OAuth 2.0, a session ID is issued. I have configured it as follows:

.maximumSessions(1)
.maxSessionsPreventsLogin(false)

With this configuration, I expected the following process:

1. User A logs in from Browser G.
2. User A logs in from Browser H.
3. At this point, the session from Browser G should expire.

However, I encountered a problem where the sessions did not expire in either browser.

Why might this issue be occurring?