protected void allowableSessionsExceeded ( List < SessionInformation > sessions , int allowableSessions , SessionRegistry registry ) throws SessionAuthenticationException { if ( exceptionIfMaximumExceeded || ( sessions == null ) ) { throw new SessionAuthenticationException ( messages . getMessage ( "ConcurrentSessionControlAuthenticationStrategy.exceededAllowed" , new Object [ ] { Integer . valueOf ( allowableSessions ) } , "Maximum sessions of {0} for this principal exceeded" ) ) ; } // Determine least recently used session, and mark it for invalidation SessionInformation leastRecentlyUsed = null ; for ( SessionInformation session : sessions ) { if ( ( leastRecentlyUsed == null ) || session . getLastRequest ( ) . before ( leastRecentlyUsed . getLastRequest ( ) ) ) { leastRecentlyUsed = session ; } } leastRecentlyUsed . expireNow ( ) ; }
Allows subclasses to customise behaviour when too many sessions are detected .