title: How to manage Session in Spring mvc
body: <p>My problem is this:
  I need to implement login/logout functionality with Spring mvc. My approach is as follows.
  I have a LoginController which handles get and post methods.</p>
  
  <pre><code>@RequestMapping(value = "/login", method = RequestMethod.GET)
  public String login(Model model) {
      if (sessionController.getSessionUserDto() != null) {
          return "redirect:/secure/admin/index";
      }
      UserDto dto = new UserDto();
      model.addAttribute("userDto", dto);
  
      return "/login";
  }
  </code></pre>
  
  <p>I have a SessionController which is a session-scoped bean that holds the user credentials.
  And this is my POST method.</p>
  
  <pre><code>@RequestMapping(value = "/login", method = RequestMethod.POST)
  public String executeLogin(@ModelAttribute("userDto") UserDto userDto, BindingResult result,
          HttpServletRequest request) {
      String[] suppressedFields = result.getSuppressedFields();
      if (suppressedFields.length &gt; 0) {
          throw new RuntimeException("Attempting to bind disallowed fields: "
                  + StringUtils.arrayToCommaDelimitedString(suppressedFields));
      }
  
      if (userDto.getUser() == null || userDto.getUser().isEmpty()) {
          return "/login";
      }
  
      if (userDto.getPassword() == null || userDto.getPassword().isEmpty()) {
          return "/login";
      }
  
      try {
          UserDto dto = userManager.login(userDto.getUser(), userDto.getPassword());
          if (dto != null) {
              sessionController.setSessionUserDto(dto);
              request.getSession().setAttribute("terminal", request.getRemoteAddr());
              return "redirect:/secure/admin/index";
          } else {
              return "/login";
          }
      } catch (DaoException ex) {
          System.out.println("DaoException: " + ex.getMessage());
          return "redirect:/login";
      }
  }
  </code></pre>
  
  <p>The issue is that every user that log into the system, always override the user stored in SessionController. That is, sessionController holds only one user for the whole application. If I login in machine A and then open machine B and request <a href="http://localhost:8080/webapp/login" rel="nofollow">http://localhost:8080/webapp/login</a>, I will be redirected to index, as if I be logged.
  So, What should I do? </p>