title: How to enable session and set session timeout in Spring Security
body: <p>I am new to Spring Security and I am working on a login, logout, and session timeout feature. I have configured my code by referring to <a href="http://docs.spring.io/spring-security/site/docs/3.2.4.RELEASE/apidocs/org/springframework/security/config/annotation/web/builders/HttpSecurity.html#sessionManagement%28%29" rel="noreferrer">this</a> document. My code looks below:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
  
      http.authorizeRequests().antMatchers("/admin/**")
          .access("hasRole('ROLE_USER')").and().formLogin()
          .loginPage("/login").failureUrl("/login?error")
              .usernameParameter("username")
              .passwordParameter("password")
              .and().logout().logoutSuccessUrl("/login?logout").and().csrf();
      http.sessionManagement().maximumSessions(1).expiredUrl("/login?expired");
  }
  </code></pre>
  
  <p><strong>Override the class AbstractSecurityWebApplicationInitializer</strong></p>
  
  <pre><code>import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;
  
  public class SpringSecurityInitializer extends AbstractSecurityWebApplicationInitializer {
  
      @Override
      public boolean enableHttpSessionEventPublisher() {
          return true;
      }
  
  }
  </code></pre>
  
  <p>I need clarification on whether I am doing it right, if it looks good, then where I need to setup the session timeout. I am doing it fully based on annotation.</p>