Add Max Session to WebFlux

[bentenzheng]

When i am using webflux , how can i achieve a similar effect ,get all login user session ,
like as :
http.sessionManagement() .maximumSessions(1).sessionRegistry(getSessionRegistry()).maxSessionsPreventsLogin(false)

[rwinch]

We do not currently support max sessions in WebFlux. I converted this issue into a ticket for that support

[ankurpathak]

Can I give it a try??

[rwinch]

@ankurpathak Sure! The ticket is yours

[ankurpathak]

@rwinch I would like to dicusss this ticket progressively:
Here is a top lable flow I am thinking to use:

class AuthenticationWebFilter {
          	private ServerSessionAuthenticationStrategy sessionAuthenticationStrategy = NullAuthenticatedServerSessionStrategy.getInstance();

               private Mono<Void> authenticate(ServerWebExchange exchange,
		WebFilterChain chain, Authentication token) {
		WebFilterExchange webFilterExchange = new WebFilterExchange(exchange, chain);
		return this.authenticationManager.authenticate(token)
			.switchIfEmpty(Mono.defer(() -> Mono.error(new IllegalStateException("No provider found for " + token.getClass()))))
			.flatMap(authentication -> sessionAuthenticationStrategy.onAuthentication(authentication, webFilterExchange.getExchange()).then(Mono.just(authentication)))
			.flatMap(authentication -> onAuthenticationSuccess(authentication, webFilterExchange))
			.onErrorResume(AuthenticationException.class, e -> this.authenticationFailureHandler
				.onAuthenticationFailure(webFilterExchange, e));
	}
}

public interface ServerSessionAuthenticationStrategy {
	Mono<Void> onAuthentication(Authentication authentication, ServerWebExchange exchange);
}

public class  NoOpServerSessionAuthenticationStrategy implements ServerSessionAuthenticationStrategy {
	Mono<Void> onAuthentication(Authentication authentication, ServerWebExchange exchange){
             return Mono.empty();
        }

}

public interface ConcurrentServerSessionAuthenticationStrategy implements ServerSessionAuthenticationStrategy{
	Mono<Void> onAuthentication(Authentication authentication, ServerWebExchange exchange){
             return Mono.error(new SessionAuthenticationException("Error"));
        }

}

1. AuthenticationWebFilter will have instanace of ServerSessionAuthenticationStrategy
2. After authentication check session counts delegating it to ServerSessionAuthenticationStrategy
3. Two implementation of ServerSessionAuthenticationStrategy NoOp and Concurrent
   4 Support for adding ServerSessionAuthenticationStrategy in all AuthenticationWebFilter in ServerHttpSecurity

[ankurpathak]

@rwinch What is equivalent of SessionRegistry in reactive world?
I think we would need ReactiveSessionRegistry for this issue as using SessionRegistry may be non
blocking for InMemoryImplementatio but may be blocking for SessionRegistry implemenation for
Redis, Mongo, JDBC in Spring Session. What do you think?

[rwinch]

We don't currently have an equivalent. Note: I'd try and reimagine the API a bit rather than copy it directly. See exactly what is needed by Spring Security and limit it to that.

[issilin]

@rwinch
Is this ticket alive? Can I try to solve this?

[mukeshkamboj]

@rwinch
Do we have any solution?

[ankurpathak]

@mukeshkamboj @rwinch I am not working on this.