title: How to set a custom invalid session strategy in Spring Security
body: <p>I'm developing a web application, based on Spring-Boot - 1.1.6, Spring -Security -3.2.5 and more.</p>
  
  <p>I'm using Java based configuration:</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class SecurityCtxConfig extends WebSecurityConfigurerAdapter {
  
  
      @Bean
      DelegatingAuthenticationEntryPoint delegatingAuthenticationEntryPoint() {
          LinkedHashMap&lt;RequestMatcher, AuthenticationEntryPoint&gt; map = new LinkedHashMap&lt;RequestMatcher, AuthenticationEntryPoint&gt;();
          Http403ForbiddenEntryPoint defaultEntryPoint = new Http403ForbiddenEntryPoint();
          map.put(AnyRequestMatcher.INSTANCE, defaultEntryPoint);
          DelegatingAuthenticationEntryPoint retVal = new DelegatingAuthenticationEntryPoint(map);
          retVal.setDefaultEntryPoint(defaultEntryPoint);
          return retVal;
      }
  
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          ExceptionHandlingConfigurer&lt;HttpSecurity&gt; exceptionHandling = http.exceptionHandling();
          exceptionHandling.authenticationEntryPoint(delegatingAuthenticationEntryPoint());
          http.logout().logoutSuccessHandler(new LogoutSuccessHandler() {
  
              @Override
              public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication arg2)
                      throws IOException, ServletException {
                  response.setStatus(HttpServletResponse.SC_OK);
              }
          });
      }
  
  }
  </code></pre>
  
  <p>The requirement is to return Http status 401 in case that the session cookie is invalid or missing(no matter the reason)
  I see the <code>InvalidSessionStrategy</code> but I don't find a way to set it on the <code>SessionManagementFilter</code>.
  Can some one please instract me how to implement my plan or another one that will fulfill the requirement</p>