title: Spring Session with Spring Security creates two sessions
body: <p>I have a Spring 4.1 web app, I use spring-security and spring session, spring session I want to use with websockets to keep the session without timeout as long as the websocket is working.</p>
  
  <p>It all works fine but what I find is that I obviously have two sessions running, one for spring security and one for spring session.</p>
  
  <p>This is my session.xml:</p>
  
  <pre><code>   &lt;bean id="jedisConnFactory" class="org.springframework.data.redis.connection.jedis.JedisConnectionFactory"&gt;
            &lt;property name="hostName" value="localhost"/&gt;
            &lt;property name="port" value="6379" /&gt;
     &lt;/bean&gt;
  
     &lt;bean class="org.springframework.session.data.redis.RedisOperationsSessionRepository" name="sessionRepository" &gt;
            &lt;constructor-arg name="redisConnectionFactory" ref="jedisConnFactory" /&gt;
            &lt;!--&lt;property name="defaultMaxInactiveInterval" value="60" /&gt;--&gt;
     &lt;/bean&gt;
  
     &lt;bean class="org.springframework.session.web.http.HeaderHttpSessionStrategy" name="sessionStrategy" /&gt;
  
     &lt;bean name="springSessionRepositoryFilter" class="org.springframework.session.web.http.SessionRepositoryFilter"&gt;
            &lt;constructor-arg name="sessionRepository" ref="sessionRepository" /&gt;
     &lt;/bean&gt;
  
     &lt;bean class="org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration" &gt;
            &lt;property name="httpSessionStrategy" ref="sessionStrategy"/&gt;
     &lt;/bean&gt;
  </code></pre>
  
  <p>And here is my security.xml:</p>
  
  <pre><code>&lt;!-- Security --&gt;
  &lt;bean id="userDetailsService" class="com.fg.ts.base.security.userdetails.CustomUserDetailsService" /&gt;
  
  &lt;bean id="passwordEncoder" class="org.springframework.security.crypto.password.StandardPasswordEncoder"&gt;
      &lt;constructor-arg value="${encoder.password}" /&gt;
  &lt;/bean&gt;
  
  &lt;sec:authentication-manager id="authenticationManager"&gt;
      &lt;sec:authentication-provider user-service-ref="userDetailsService"&gt;
          &lt;sec:password-encoder ref="passwordEncoder" /&gt;
      &lt;/sec:authentication-provider&gt;
  &lt;/sec:authentication-manager&gt;
  
  &lt;sec:global-method-security pre-post-annotations="enabled" secured-annotations="disabled"
                              jsr250-annotations="enabled" authentication-manager-ref="authenticationManager" /&gt;
  
  &lt;!-- Exclude the resources+error+auth pages from security filter --&gt;
  &lt;sec:http pattern="/javax.faces.resource/**" security="none" /&gt;
  &lt;sec:http pattern="/images/**" security="none" /&gt;
  &lt;sec:http pattern="/css/**" security="none" /&gt;
  &lt;sec:http pattern="/ico/**" security="none" /&gt;
  &lt;sec:http pattern="/lib/**" security="none" /&gt;
  &lt;sec:http pattern="/js/**" security="none" /&gt;
  &lt;sec:http pattern="/auth/**" security="none" /&gt;
  &lt;sec:http pattern="/error/**" security="none" /&gt;
  &lt;sec:http pattern="/api/concordancer/search/**" security="none" /&gt;
  &lt;sec:http pattern="/concordancer/search" security="none"/&gt;
  &lt;sec:http pattern="/assets/cdSearch.xhtml" security="none"/&gt;
  &lt;sec:http pattern="/api/tmGroup/**" security="none"/&gt;
  &lt;sec:http pattern="/api/reports/download/**" security="none"/&gt;
  &lt;sec:http pattern="/api/socket/tasks/info/**" security="none"/&gt;
  
  &lt;!-- Security Configuration for Faces Pages --&gt;
  &lt;!-- Start Customization for Faces --&gt;
  &lt;!-- ***************************** --&gt;
  &lt;!-- Failure Login Handler --&gt;
  &lt;bean id="authenticationFailureHandler" class="com.fg.ts.web.util.security.LoginFailureHandler"&gt;
      &lt;property name="defaultFailureUrl" value="/auth/login" /&gt;
  &lt;/bean&gt;
  
  &lt;!-- Faces Redirect --&gt;
  &lt;bean id="facesRedirectStrategy" class="com.fg.ts.web.util.security.FacesRedirectStrategy"&gt;
      &lt;property name="invalidSessionUrl" value="/auth/login/sessionExpired" /&gt;
  &lt;/bean&gt;
  &lt;!-- Shared Objects --&gt;
  &lt;bean id="securityContextRepository" class="org.springframework.security.web.context.HttpSessionSecurityContextRepository" /&gt;
  &lt;bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" /&gt;
  
  
  &lt;!-- Session Authentication Strategy --&gt;
  &lt;bean id="sessionFixationAuthenticationStrategy" class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy" /&gt;
  &lt;bean id="registerSessionStrategy" class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy"&gt;
      &lt;constructor-arg name="sessionRegistry" ref="sessionRegistry" /&gt;
  &lt;/bean&gt;
  &lt;bean id="sessionAuthenticationStrategy" class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy"&gt;
      &lt;constructor-arg name="delegateStrategies"&gt;
          &lt;list&gt;
              &lt;!-- &lt;ref bean="concurrentSessionStrategy" /&gt; --&gt;
              &lt;ref bean="sessionFixationAuthenticationStrategy" /&gt;
              &lt;ref bean="registerSessionStrategy" /&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  
  &lt;!-- Remember-Me Service --&gt;
  &lt;bean id="rememberMeServices" class="org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices"&gt;
      &lt;constructor-arg name="key" value="${encoder.password}" /&gt;
      &lt;constructor-arg name="userDetailsService" ref="userDetailsService" /&gt;
      &lt;property name="parameter" value="j_remember_me" /&gt;
      &lt;property name="cookieName" value="TMS_REME" /&gt;
  &lt;/bean&gt;
  
  &lt;!-- Filters --&gt;
  &lt;bean id="usernamePasswordAuthenticationFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;property name="sessionAuthenticationStrategy" ref="sessionAuthenticationStrategy" /&gt;
      &lt;property name="rememberMeServices" ref="rememberMeServices" /&gt;
      &lt;property name="authenticationFailureHandler" ref="authenticationFailureHandler" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="sessionManagementFilter" class="org.springframework.security.web.session.SessionManagementFilter"&gt;
      &lt;constructor-arg name="securityContextRepository" ref="securityContextRepository" /&gt;
      &lt;constructor-arg name="sessionStrategy" ref="sessionAuthenticationStrategy" /&gt;
      &lt;property name="invalidSessionStrategy" ref="facesRedirectStrategy" /&gt;
      &lt;property name="authenticationFailureHandler" ref="authenticationFailureHandler" /&gt;
  &lt;/bean&gt;
   &lt;bean id="concurrentSessionFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter"&gt;
      &lt;constructor-arg name="sessionRegistry" ref="sessionRegistry" /&gt;
      &lt;constructor-arg name="expiredUrl" value="/auth/login/expiredDueToConcurrentAccess" /&gt;
      &lt;property name="redirectStrategy" ref="facesRedirectStrategy" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="authEntryPoint" class="com.fg.ts.web.util.security.FacesLoginUrlAuthenticationEntryPoint"&gt;
      &lt;property name="loginFormUrl" value="/auth/login"/&gt;
  &lt;/bean&gt;
  &lt;!-- End Customization for Faces --&gt;
  &lt;!-- ***************************** --&gt;
  
  &lt;sec:http use-expressions="true" disable-url-rewriting="true" authentication-manager-ref="authenticationManager"
            entry-point-ref="authEntryPoint"&gt; &lt;!--security-context-repository-ref="securityContextRepository"--&gt;
      &lt;sec:http-basic /&gt;
  
  
      &lt;sec:custom-filter ref="usernamePasswordAuthenticationFilter" before="FORM_LOGIN_FILTER" /&gt;
      &lt;sec:custom-filter ref="sessionManagementFilter" position="SESSION_MANAGEMENT_FILTER" /&gt;
      &lt;sec:anonymous /&gt;
      &lt;sec:remember-me key="${encoder.password}" services-ref="rememberMeServices" /&gt;
      &lt;sec:form-login login-page="/auth/login" authentication-failure-handler-ref="authenticationFailureHandler" /&gt;
      &lt;sec:logout logout-url="/logout" invalidate-session="true" delete-cookies="TMS_SES,TMS_REME"
                  logout-success-url="/auth/login" /&gt;
  
  
      &lt;sec:session-management session-fixation-protection="none" /&gt;
  
      &lt;!-- General Access Control --&gt;
      &lt;sec:intercept-url pattern="/projects/**" access="hasAnyRole('ROLE_ADMIN','ROLE_PM')" /&gt;
      &lt;sec:intercept-url pattern="/assets/**" access="hasAnyRole('ROLE_ADMIN','ROLE_PM')" /&gt;
      &lt;sec:intercept-url pattern="/setup/**" access="hasAnyRole('ROLE_ADMIN','ROLE_PM')" /&gt;
      &lt;sec:intercept-url pattern="/tm/**" access="hasAnyRole('ROLE_ADMIN','ROLE_PM')" /&gt;
      &lt;sec:intercept-url pattern="/termBase/**" access="hasAnyRole('ROLE_ADMIN','ROLE_PM')" /&gt;
      &lt;sec:intercept-url pattern="/quality/**" access="hasAnyRole('ROLE_ADMIN','ROLE_PM')" /&gt;
      &lt;sec:intercept-url pattern="/editor/**" access="isAuthenticated()" /&gt;
      &lt;sec:intercept-url pattern="/api/**" access="isAuthenticated()" /&gt;
      &lt;sec:intercept-url pattern="/**" access="isAuthenticated()" /&gt;
  &lt;/sec:http&gt;
  </code></pre>
  
  <p>How can I make spring security use the session created by spring-session ?</p>